Aerial Service

ABSTRACT

A mobility management entity (MME) receives, from a first base station, a request for a handover of a wireless device to a second base station. Based on the handover request, the MME sends, to an access and mobility management function (AMF), an indication of an authentication and/or authorization (AA) status for an aerial service of the wireless device.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of International Application No.PCT/US2021/061983, filed Dec. 6, 2021, which claims the benefit of U.S.Provisional Application No. 63/126,285, filed Dec. 16, 2020, all ofwhich are hereby incorporated by reference in their entireties.

BRIEF DESCRIPTION OF THE DRAWINGS

Examples of several of the various embodiments of the present disclosureare described herein with reference to the drawings.

FIG. 1A and FIG. 1B illustrate example communication networks includingan access network and a core network.

FIG. 2A, FIG. 2B, FIG. 2C, and FIG. 2D illustrate various examples of aframework for a service-based architecture within a core network.

FIG. 3 illustrates an example communication network including corenetwork functions.

FIG. 4A and FIG. 4B illustrate example of core network architecture withmultiple user plane functions and untrusted access.

FIG. 5 illustrates an example of a core network architecture for aroaming scenario.

FIG. 6 illustrates an example of network slicing.

FIG. 7A, FIG. 7B, and FIG. 7C illustrate a user plane protocol stack, acontrol plane protocol stack, and services provided between protocollayers of the user plane protocol stack.

FIG. 8 illustrates an example of a quality of service model for dataexchange.

FIG. 9A, FIG. 9B, FIG. 9C, and FIG. 9D illustrate example states andstate transitions of a wireless device.

FIG. 10 illustrates an example of a registration procedure for awireless device.

FIG. 11 illustrates an example of a service request procedure for awireless device.

FIG. 12 illustrates an example of a protocol data unit sessionestablishment procedure for a wireless device.

FIG. 13 illustrates examples of components of the elements in acommunications network.

FIG. 14A, FIG. 14B, FIG. 14C, and FIG. 14D illustrate various examplesof physical core network deployments, each having one or more networkfunctions or portions thereof.

FIG. 15 illustrates a service-based architecture for a 5G networkregarding interaction between a control plane (CP) and a user plane(UP).

FIG. 16 illustrates an example architecture of an unmanned and/oruncrewed aerial system (UAS) in accordance with embodiments of thepresent disclosure.

FIG. 17 illustrates an example scenario how an unmanned and/or uncrewedaerial vehicle interacts with base stations regarding interference inaccordance with embodiments of the present disclosure.

FIG. 18 illustrates an example architecture for an unmanned and/oruncrewed aerial system regarding interfaces in accordance withembodiments of the present disclosure.

FIG. 19 illustrates an example registration procedure regarding anauthentication and/or authorization for an aerial service in accordancewith embodiments of the present disclosure.

FIG. 20 illustrates example service specific authentication and/orauthorization procedure in accordance with embodiments of the presentdisclosure.

FIG. 21 depicts a 4G network comprising of 4G access network (e.g.,E-UTRAN) and 4G core network (e.g., evolved packet system) in accordancewith embodiments of the present disclosure.

FIG. 22 depicts an architecture for interworking between 4G system and5G system in accordance with embodiments of the present disclosure.

FIG. 23 illustrates an example authentication and/or authorizationprocedure for 4G network in accordance with embodiments of the presentdisclosure.

FIG. 24 illustrates an example session establishment procedure for 4Gnetwork in accordance with embodiments of the present disclosure.

FIG. 25 illustrates an example inter-system handover procedure regardingthe UAS service in accordance with embodiments of the presentdisclosure.

FIG. 26 illustrates an example procedure in 5G network regarding the 5Gnetwork determines a network node for an AA procedure for the UASservice in accordance with embodiments of the present disclosure.

DETAILED DESCRIPTION

In the present disclosure, various embodiments are presented as examplesof how the disclosed techniques may be implemented and/or how thedisclosed techniques may be practiced in environments and scenarios. Itwill be apparent to persons skilled in the relevant art that variouschanges in form and detail can be made therein without departing fromthe scope. In fact, after reading the description, it will be apparentto one skilled in the relevant art how to implement alternativeembodiments. The present embodiments should not be limited by any of thedescribed exemplary embodiments. The embodiments of the presentdisclosure will be described with reference to the accompanyingdrawings. Limitations, features, and/or elements from the disclosedexample embodiments may be combined to create further embodiments withinthe scope of the disclosure. Any figures which highlight thefunctionality and advantages, are presented for example purposes only.The disclosed architecture is sufficiently flexible and configurable,such that it may be utilized in ways other than that shown. For example,the actions listed in any flowchart may be re-ordered or only optionallyused in some embodiments.

Embodiments may be configured to operate as needed. The disclosedmechanism may be performed when certain criteria are met, for example,in a wireless device, a base station, a radio environment, a network, acombination of the above, and/or the like. Example criteria may bebased, at least in part, on for example, wireless device or network nodeconfigurations, traffic load, initial system set up, packet sizes,traffic characteristics, a combination of the above, and/or the like.When the one or more criteria are met, various example embodiments maybe applied. Therefore, it may be possible to implement exampleembodiments that selectively implement disclosed protocols.

A base station may communicate with a mix of wireless devices. Wirelessdevices and/or base stations may support multiple technologies, and/ormultiple releases of the same technology. Wireless devices may have oneor more specific capabilities. When this disclosure refers to a basestation communicating with a plurality of wireless devices, thisdisclosure may refer to a subset of the total wireless devices in acoverage area. This disclosure may refer to, for example, a plurality ofwireless devices of a given LTE or 5G release with a given capabilityand in a given sector of the base station. The plurality of wirelessdevices in this disclosure may refer to a selected plurality of wirelessdevices, and/or a subset of total wireless devices in a coverage areawhich perform according to disclosed methods, and/or the like. There maybe a plurality of base stations or a plurality of wireless devices in acoverage area that may not comply with the disclosed methods, forexample, those wireless devices or base stations may perform based onolder releases of LTE or 5G technology.

In this disclosure, “a” and “an” and similar phrases refer to a singleinstance of a particular element, but should not be interpreted toexclude other instances of that element. For example, a bicycle with twowheels may be described as having “a wheel”. Any term that ends with thesuffix “(s)” is to be interpreted as “at least one” and/or “one ormore.” In this disclosure, the term “may” is to be interpreted as “may,for example.” In other words, the term “may” is indicative that thephrase following the term “may” is an example of one of a multitude ofsuitable possibilities that may, or may not, be employed by one or moreof the various embodiments. The terms “comprises” and “consists of”, asused herein, enumerate one or more components of the element beingdescribed. The term “comprises” is interchangeable with “includes” anddoes not exclude unenumerated components from being included in theelement being described. By contrast, “consists of” provides a completeenumeration of the one or more components of the element beingdescribed.

The phrases “based on”, “in response to”, “depending on”, “employing”,“using”, and similar phrases indicate the presence and/or influence of aparticular factor and/or condition on an event and/or action, but do notexclude unenumerated factors and/or conditions from also being presentand/or influencing the event and/or action. For example, if action X isperformed “based on” condition Y, this is to be interpreted as theaction being performed “based at least on” condition Y. For example, ifthe performance of action X is performed when conditions Y and Z areboth satisfied, then the performing of action X may be described asbeing “based on Y”.

The term “configured” may relate to the capacity of a device whether thedevice is in an operational or non-operational state. Configured mayrefer to specific settings in a device that effect the operationalcharacteristics of the device whether the device is in an operational ornon-operational state. In other words, the hardware, software, firmware,registers, memory values, and/or the like may be “configured” within adevice, whether the device is in an operational or nonoperational state,to provide the device with specific characteristics. Terms such as “acontrol message to cause in a device” may mean that a control messagehas parameters that may be used to configure specific characteristics ormay be used to implement certain actions in the device, whether thedevice is in an operational or non-operational state.

In this disclosure, a parameter may comprise one or more informationobjects, and an information object may comprise one or more otherobjects. For example, if parameter J comprises parameter K, andparameter K comprises parameter L, and parameter L comprises parameterM, then J comprises L, and J comprises M. A parameter may be referred toas a field or information element. In an example embodiment, when one ormore messages comprise a plurality of parameters, it implies that aparameter in the plurality of parameters is in at least one of the oneor more messages, but does not have to be in each of the one or moremessages.

This disclosure may refer to possible combinations of enumeratedelements. For the sake of brevity and legibility, the present disclosuredoes not explicitly recite each and every permutation that may beobtained by choosing from a set of optional features. The presentdisclosure is to be interpreted as explicitly disclosing all suchpermutations. For example, the seven possible combinations of enumeratedelements A, B, C consist of: (1) “A”; (2) “B”; (3) “C”; (4) “A and B”;(5) “A and C”; (6) “B and C”; and (7) “A, B, and C”. For the sake ofbrevity and legibility, these seven possible combinations may bedescribed using any of the following interchangeable formulations: “atleast one of A, B, and C”; “at least one of A, B, or C”; “one or more ofA, B, and C”; “one or more of A, B, or C”; “A, B, and/or C”. It will beunderstood that impossible combinations are excluded. For example, “Xand/or not-X” should be interpreted as “X or not-X”. It will be furtherunderstood that these formulations may describe alternative phrasings ofoverlapping and/or synonymous concepts, for example, “identifier,identification, and/or ID number”.

This disclosure may refer to sets and/or subsets. As an example, set Xmay be a set of elements comprising one or more elements. If everyelement of X is also an element of Y, then X may be referred to as asubset of Y. In this disclosure, only non-empty sets and subsets areconsidered. For example, if Y consists of the elements Y1, Y2, and Y3,then the possible subsets of Y are {Y1, Y2, Y3}, {Y1, Y2}, {Y1, Y3},{Y2, Y3}, {Y1}, {Y2}, and {Y3}.

FIG. 1A illustrates an example of a communication network 100 in whichembodiments of the present disclosure may be implemented. Thecommunication network 100 may comprise, for example, a public landmobile network (PLMN) run by a network operator. As illustrated in FIG.1A, the communication network 100 includes a wireless device 101, anaccess network (AN) 102, a core network (CN) 105, and one or more datanetwork (DNs) 108.

The wireless device 101 may communicate with DNs 108 via AN 102 and CN105. In the present disclosure, the term wireless device may refer toand encompass any mobile device or fixed (non-mobile) device for whichwireless communication is needed or usable. For example, a wirelessdevice may be a telephone, smart phone, tablet, computer, laptop,sensor, meter, wearable device, Internet of Things (IoT) device, vehicleroad side unit (RSU), relay node, automobile, unmanned and/or uncrewedaerial vehicle, urban air mobility, and/or any combination thereof. Theterm wireless device encompasses other terminology, including userequipment (UE), user terminal (UT), access terminal (AT), mobilestation, handset, wireless transmit and receive unit (WTRU), and/orwireless communication device.

The AN 102 may connect wireless device 101 to CN 105 in any suitablemanner. The communication direction from the AN 102 to the wirelessdevice 101 is known as the downlink and the communication direction fromthe wireless device 101 to AN 102 is known as the uplink. Downlinktransmissions may be separated from uplink transmissions using frequencydivision duplexing (FDD), time-division duplexing (TDD), and/or somecombination of the two duplexing techniques. The AN 102 may connect towireless device 101 through radio communications over an air interface.An access network that at least partially operates over the airinterface may be referred to as a radio access network (RAN). The CN 105may set up one or more end-to-end connection between wireless device 101and the one or more DNs 108. The CN 105 may authenticate wireless device101 and provide charging functionality.

In the present disclosure, the term base station may refer to andencompass any element of AN 102 that facilitates communication betweenwireless device 101 and AN 102. Access networks and base stations havemany different names and implementations. The base station may be aterrestrial base station fixed to the earth. The base station may be amobile base station with a moving coverage area. The base station may bein space, for example, on board a satellite. For example, WiFi and otherstandards may use the term access point. As another example, theThird-Generation Partnership Project (3GPP) has produced specificationsfor three generations of mobile networks, each of which uses differentterminology. Third Generation (3G) and/or Universal MobileTelecommunications System (UMTS) standards may use the term Node B. 4G,Long Term Evolution (LTE), and/or Evolved Universal Terrestrial RadioAccess (E-UTRA) standards may use the term Evolved Node B (eNB). 5Gand/or New Radio (NR) standards may describe AN 102 as a next-generationradio access network (NG-RAN) and may refer to base stations as NextGeneration eNB (ng-eNB) and/or Generation Node B (gNB). Future standards(for example, 6G, 7G, 8G) may use new terminology to refer to theelements which implement the methods described in the present disclosure(e.g., wireless devices, base stations, ANs, CNs, and/or componentsthereof). A base station may be implemented as a repeater or relay nodeused to extend the coverage area of a donor node. A repeater node mayamplify and rebroadcast a radio signal received from a donor node. Arelay node may perform the same/similar functions as a repeater node butmay decode the radio signal received from the donor node to remove noisebefore amplifying and rebroadcasting the radio signal.

The AN 102 may include one or more base stations, each having one ormore coverage areas. The geographical size and/or extent of a coveragearea may be defined in terms of a range at which a receiver of AN 102can successfully receive transmissions from a transmitter (e.g.,wireless device 101) operating within the coverage area (and/orvice-versa). The coverage areas may be referred to as sectors or cells(although in some contexts, the term cell refers to the carrierfrequency used in a particular coverage area, rather than the coveragearea itself). Base stations with large coverage areas may be referred toas macrocell base stations. Other base stations cover smaller areas, forexample, to provide coverage in areas with weak macrocell coverage, orto provide additional coverage in areas with high traffic (sometimesreferred to as hotspots). Examples of small cell base stations include,in order of decreasing coverage area, microcell base stations, picocellbase stations, and femtocell base stations or home base stations.Together, the coverage areas of the base stations may provide radiocoverage to wireless device 101 over a wide geographic area to supportwireless device mobility.

A base station may include one or more sets of antennas forcommunicating with the wireless device 101 over the air interface. Eachset of antennas may be separately controlled by the base station. Eachset of antennas may have a corresponding coverage area. As an example, abase station may include three sets of antennas to respectively controlthree coverage areas on three different sides of the base station. Theentirety of the base station (and its corresponding antennas) may bedeployed at a single location. Alternatively, a controller at a centrallocation may control one or more sets of antennas at one or moredistributed locations. The controller may be, for example, a basebandprocessing unit that is part of a centralized or cloud RAN architecture.The baseband processing unit may be either centralized in a pool ofbaseband processing units or virtualized. A set of antennas at adistributed location may be referred to as a remote radio head (RRH).

FIG. 1B illustrates another example communication network 150 in whichembodiments of the present disclosure may be implemented. Thecommunication network 150 may comprise, for example, a PLMN run by anetwork operator. As illustrated in FIG. 1B, communication network 150includes UEs 151, a next generation radio access network (NG-RAN) 152, a5G core network (5G-CN) 155, and one or more DNs 158. The NG-RAN 152includes one or more base stations, illustrated as generation node Bs(gNBs) 152A and next generation evolved Node Bs (ng eNBs) 152B. The5G-CN 155 includes one or more network functions (NFs), includingcontrol plane functions 155A and user plane functions 155B. The one ormore DNs 158 may comprise public DNs (e.g., the Internet), private DNs,and/or intra-operator DNs. Relative to corresponding componentsillustrated in FIG. 1A, these components may represent specificimplementations and/or terminology.

The base stations of the NG-RAN 152 may be connected to the UEs 151 viaUu interfaces. The base stations of the NG-RAN 152 may be connected toeach other via Xn interfaces. The base stations of the NG-RAN 152 may beconnected to 5G CN 155 via NG interfaces. The Uu interface may includean air interface. The NG and Xn interfaces may include an air interface,or may consist of direct physical connections and/or indirectconnections over an underlying transport network (e.g., an internetprotocol (IP) transport network).

Each of the Uu, Xn, and NG interfaces may be associated with a protocolstack. The protocol stacks may include a user plane (UP) and a controlplane (CP). Generally, user plane data may include data pertaining tousers of the UEs 151, for example, internet content downloaded via a webbrowser application, sensor data uploaded via a tracking application, oremail data communicated to or from an email server. Control plane data,by contrast, may comprise signaling and messages that facilitatepackaging and routing of user plane data so that it can be exchangedwith the DN(s). The NG interface, for example, may be divided into an NGuser plane interface (NG-U) and an NG control plane interface (NG-C).The NG-U interface may provide delivery of user plane data between thebase stations and the one or more user plane network functions 155B. TheNG-C interface may be used for control signaling between the basestations and the one or more control plane network functions 155A. TheNG-C interface may provide, for example, NG interface management, UEcontext management, UE mobility management, transport of NAS messages,paging, PDU session management, and configuration transfer and/orwarning message transmission. In some cases, the NG-C interface maysupport transmission of user data (for example, a small datatransmission for an IoT device).

One or more of the base stations of the NG-RAN 152 may be split into acentral unit (CU) and one or more distributed units (DUs). A CU may becoupled to one or more DUs via an F1 interface. The CU may handle one ormore upper layers in the protocol stack and the DU may handle one ormore lower layers in the protocol stack. For example, the CU may handleRRC, PDCP, and SDAP, and the DU may handle RLC, MAC, and PHY. The one ormore DUs may be in geographically diverse locations relative to the CUand/or each other. Accordingly, the CU/DU split architecture may permitincreased coverage and/or better coordination.

The gNBs 152A and ng-eNBs 152B may provide different user plane andcontrol plane protocol termination towards the UEs 151. For example, thegNB 154A may provide new radio (NR) protocol terminations over a Uuinterface associated with a first protocol stack. The ng-eNBs 152B mayprovide Evolved UMTS Terrestrial Radio Access (E-UTRA) protocolterminations over a Uu interface associated with a second protocolstack.

The 5G-CN 155 may authenticate UEs 151, set up end-to-end connectionsbetween UEs 151 and the one or more DNs 158, and provide chargingfunctionality. The 5G-CN 155 may be based on a service-basedarchitecture, in which the NFs making up the 5G-CN 155 offer services toeach other and to other elements of the communication network 150 viainterfaces. The 5G-CN 155 may include any number of other NFs and anynumber of instances of each NF.

FIG. 2A, FIG. 2B, FIG. 2C, and FIG. 2D illustrate various examples of aframework for a service-based architecture within a core network. In aservice-based architecture, a service may be sought by a serviceconsumer and provided by a service producer. Prior to obtaining aparticular service, an NF may determine where such as service can beobtained. To discover a service, the NF may communicate with a networkrepository function (NRF). As an example, an NF that provides one ormore services may register with a network repository function (NRF). TheNRF may store data relating to the one or more services that the NF isprepared to provide to other NFs in the service-based architecture. Aconsumer NF may query the NRF to discover a producer NF (for example, byobtaining from the NRF a list of NF instances that provide a particularservice).

In the example of FIG. 2A, an NF 211 (a consumer NF in this example) maysend a request 221 to an NF 212 (a producer NF). The request 221 may bea request for a particular service and may be sent based on a discoverythat NF 212 is a producer of that service. The request 221 may comprisedata relating to NF 211 and/or the requested service. The NF 212 mayreceive request 221, perform one or more actions associated with therequested service (e.g., retrieving data), and provide a response 221.The one or more actions performed by the NF 212 may be based on requestdata included in the request 221, data stored by NF 212, and/or dataretrieved by NF 212. The response 222 may notify NF 211 that the one ormore actions have been completed. The response 222 may comprise responsedata relating to NF 212, the one or more actions, and/or the requestedservice.

In the example of FIG. 2B, an NF 231 sends a request 241 to an NF 232.In this example, part of the service produced by NF 232 is to send arequest 242 to an NF 233. The NF 233 may perform one or more actions andprovide a response 243 to NF 232. Based on response 243, NF 232 may senda response 244 to NF 231. It will be understood from FIG. 2B that asingle NF may perform the role of producer of services, consumer ofservices, or both. A particular NF service may include any number ofnested NF services produced by one or more other NFs.

FIG. 2C illustrates examples of subscribe-notify interactions between aconsumer NF and a producer NF. In FIG. 2C, an NF 251 sends asubscription 261 to an NF 252. An NF 253 sends a subscription 262 to theNF 252. Two NFs are shown in FIG. 2C for illustrative purposes (todemonstrate that the NF 252 may provide multiple subscription servicesto different NFs), but it will be understood that a subscribe-notifyinteraction only requires one subscriber. The NFs 251, 253 may beindependent from one another. For example, the NFs 251, 253 mayindependently discover NF 252 and/or independently determine tosubscribe to the service offered by NF 252. In response to receipt of asubscription, the NF 252 may provide a notification to the subscribingNF. For example, NF 252 may send a notification 263 to NF 251 based onsubscription 261 and may send a notification 264 to NF 253 based onsubscription 262.

As shown in the example illustration of FIG. 2C, the sending of thenotifications 263, 264 may be based on a determination that a conditionhas occurred. For example, the notifications 263, 264 may be based on adetermination that a particular event has occurred, a determination thata particular condition is outstanding, and/or a determination that aduration of time associated with the subscription has elapsed (forexample, a period associated with a subscription for periodicnotifications). As shown in the example illustration of FIG. 2C, NF 252may send notifications 263, 264 to NFs 251, 253 simultaneously and/or inresponse to the same condition. However, it will be understood that theNF 252 may provide notifications at different times and/or in responseto different notification conditions. In an example, the NF 251 mayrequest a notification when a certain parameter, as measured by the NF252, exceeds a first threshold, and the NF 252 may request anotification when the parameter exceeds a second threshold differentfrom the first threshold. In an example, a parameter of interest and/ora corresponding threshold may be indicated in the subscriptions 261,262.

FIG. 2D illustrates another example of a subscribe-notify interaction.In FIG. 2D, an NF 271 sends a subscription 281 to an NF 272. In responseto receipt of subscription 281 and/or a determination that anotification condition has occurred, NF 272 may send a notification 284.The notification 284 may be sent to an NF 273. Unlike the example inFIG. 2C (in which a notification is sent to the subscribing NF), FIG. 2Ddemonstrates that a subscription and its corresponding notification maybe associated with different NFs. For example, NF 271 may subscribe tothe service provided by NF 272 on behalf of NF 273.

FIG. 3 illustrates another example communication network 300 in whichembodiments of the present disclosure may be implemented. Communicationnetwork 300 includes a user equipment (UE) 301, an access network (AN)302, and a data network (DN) 308. The remaining elements depicted inFIG. 3 may be included in and/or associated with a core network. Eachelement of the core network may be referred to as a network function(NF).

The NFs depicted in FIG. 3 include a user plane function (UPF) 305, anaccess and mobility management function (AMF) 312, a session managementfunction (SMF) 314, a policy control function (PCF) 320, a networkrepository function (NRF) 330, a network exposure function (NEF) 340, aunified data management (UDM) 350, an authentication server function(AUSF) 360, a network slice selection function (NSSF) 370, a chargingfunction (CHF) 380, a network data analytics function (NWDAF) 390, andan application function (AF) 399. The UPF 305 may be a user-plane corenetwork function, whereas the NFs 312, 314, and 320-390 may becontrol-plane core network functions. Although not shown in the exampleof FIG. 3 , the core network may include additional instances of any ofthe NFs depicted and/or one or more different NF types that providedifferent services. Other examples of NF type include a gateway mobilelocation center (GMLC), a location management function (LMF), anoperations, administration, and maintenance function (OAM), a publicwarning system (PWS), a short message service function (SMSF), a unifieddata repository (UDR), and an unstructured data storage function (UDSF).

Each element depicted in FIG. 3 has an interface with at least one otherelement. The interface may be a logical connection rather than, forexample, a direct physical connection. Any interface may be identifiedusing a reference point representation and/or a service-basedrepresentation. In a reference point representation, the letter ‘N’ isfollowed by a numeral, indicating an interface between two specificelements. For example, as shown in FIG. 3 , AN 302 and UPF 305 interfacevia ‘N3’, whereas UPF 305 and DN 308 interface via ‘N6’. By contrast, ina service-based representation, the letter ‘N’ is followed by letters.The letters identify an NF that provides services to the core network.For example, PCF 320 may provide services via interface ‘Npcf’. The PCF320 may provide services to any NF in the core network via ‘Npcf’.Accordingly, a service-based representation may correspond to a bundleof reference point representations. For example, the Npcf interfacebetween PCF 320 and the core network generally may correspond to an N7interface between PCF 320 and SMF 314, an N30 interface between PCF 320and NEF 340, etc.

The UPF 305 may serve as a gateway for user plane traffic between AN 302and DN 308. The UE 301 may connect to UPF 305 via a Uu interface and anN3 interface (also described as NG-U interface). The UPF 305 may connectto DN 308 via an N6 interface. The UPF 305 may connect to one or moreother UPFs (not shown) via an N9 interface. The UE 301 may be configuredto receive services through a protocol data unit (PDU) session, which isa logical connection between UE 301 and DN 308. The UPF 305 (or aplurality of UPFs if desired) may be selected by SMF 314 to handle aparticular PDU session between UE 301 and DN 308. The SMF 314 maycontrol the functions of UPF 305 with respect to the PDU session. TheSMF 314 may connect to UPF 305 via an N4 interface. The UPF 305 mayhandle any number of PDU sessions associated with any number of UEs (viaany number of ANs). For purposes of handling the one or more PDUsessions, UPF 305 may be controlled by any number of SMFs via any numberof corresponding N4 interfaces.

The AMF 312 depicted in FIG. 3 may control UE access to the corenetwork. The UE 301 may register with the network via AMF 312. It may benecessary for UE 301 to register prior to establishing a PDU session.The AMF 312 may manage a registration area of UE 301, enabling thenetwork to track the physical location of UE 301 within the network. Fora UE in connected mode, AMF 312 may manage UE mobility, for example,handovers from one AN or portion thereof to another. For a UE in idlemode, AMF 312 may perform registration updates and/or page the UE totransition the UE to connected mode.

The AMF 312 may receive, from UE 301, non-access stratum (NAS) messagestransmitted in accordance with NAS protocol. NAS messages relate tocommunications between UE 301 and the core network. Although NASmessages may be relayed to AMF 312 via AN 302, they may be described ascommunications via the N1 interface. NAS messages may facilitate UEregistration and mobility management, for example, by authenticating,identifying, configuring, and/or managing a connection of UE 301. NASmessages may support session management procedures for maintaining userplane connectivity and quality of service (QoS) of a session between UE301 and DN 309. If the NAS message involves session management, AMF 312may send the NAS message to SMF 314. NAS messages may be used totransport messages between UE 301 and other components of the corenetwork (e.g., core network components other than AMF 312 and SMF 314).The AMF 312 may act on a particular NAS message itself, oralternatively, forward the NAS message to an appropriate core networkfunction (e.g., SMF 314, etc.)

The SMF 314 depicted in FIG. 3 may establish, modify, and/or release aPDU session based on messaging received UE 301. The SMF 314 mayallocate, manage, and/or assign an IP address to UE 301, for example,upon establishment of a PDU session. There may be multiple SMFs in thenetwork, each of which may be associated with a respective group ofwireless devices, base stations, and/or UPFs. A UE with multiple PDUsessions may be associated with a different SMF for each PDU session. Asnoted above, SMF 314 may select one or more UPFs to handle a PDU sessionand may control the handling of the PDU session by the selected UPF byproviding rules for packet handling (PDR, FAR, QER, etc.). Rulesrelating to QoS and/or charging for a particular PDU session may beobtained from PCF 320 and provided to UPF 305.

The PCF 320 may provide, to other NFs, services relating to policyrules. The PCF 320 may use subscription data and information aboutnetwork conditions to determine policy rules and then provide the policyrules to a particular NF which may be responsible for enforcement ofthose rules. Policy rules may relate to policy control for access andmobility, and may be enforced by the AMF. Policy rules may relate tosession management, and may be enforced by the SMF 314. Policy rules maybe, for example, network-specific, wireless device-specific,session-specific, or data flow-specific.

The NRF 330 may provide service discovery. The NRF 330 may belong to aparticular PLMN. The NRF 330 may maintain NF profiles relating to otherNFs in the communication network 300. The NF profile may include, forexample, an address, PLMN, and/or type of the NF, a slice identifier, alist of the one or more services provided by the NF, and theauthorization required to access the services.

The NEF 340 depicted in FIG. 3 may provide an interface to externaldomains, permitting external domains to selectively access the controlplane of the communication network 300. The external domain maycomprise, for example, third-party network functions, applicationfunctions, etc. The NEF 340 may act as a proxy between external elementsand network functions such as AMF 312, SMF 314, PCF 320, UDM 350, etc.As an example, NEF 340 may determine a location or reachability statusof UE 301 based on reports from AMF 312, and provide status informationto an external element. As an example, an external element may provide,via NEF 340, information that facilitates the setting of parameters forestablishment of a PDU session. The NEF 340 may determine which data andcapabilities of the control plane are exposed to the external domain.The NEF 340 may provide secure exposure that authenticates and/orauthorizes an external entity to which data or capabilities of thecommunication network 300 are exposed. The NEF 340 may selectivelycontrol the exposure such that the internal architecture of the corenetwork is hidden from the external domain.

The UDM 350 may provide data storage for other NFs. The UDM 350 maypermit a consolidated view of network information that may be used toensure that the most relevant information can be made available todifferent NFs from a single resource. The UDM 350 may store and/orretrieve information from a unified data repository (UDR). For example,UDM 350 may obtain user subscription data relating to UE 301 from theUDR.

The AUSF 360 may support mutual authentication of UE 301 by the corenetwork and authentication of the core network by UE 301. The AUSF 360may perform key agreement procedures and provide keying material thatcan be used to improve security.

The NSSF 370 may select one or more network slices to be used by the UE301. The NSSF 370 may select a slice based on slice selectioninformation. For example, the NSSF 370 may receive Single Network SliceSelection Assistance Information (S-NSSAI) and map the S-NSSAI to anetwork slice instance identifier (NSI).

The CHF 380 may control billing-related tasks associated with UE 301.For example, UPF 305 may report traffic usage associated with UE 301 toSMF 314. The SMF 314 may collect usage data from UPF 305 and one or moreother UPFs. The usage data may indicate how much data is exchanged, whatDN the data is exchanged with, a network slice associated with the data,or any other information that may influence billing. The SMF 314 mayshare the collected usage data with the CHF. The CHF may use thecollected usage data to perform billing-related tasks associated with UE301. The CHF may, depending on the billing status of UE 301, instructSMF 314 to limit or influence access of UE 301 and/or to providebilling-related notifications to UE 301.

The NWDAF 390 may collect and analyze data from other network functionsand offer data analysis services to other network functions. As anexample, NWDAF 390 may collect data relating to a load level for aparticular network slice instance from UPF 305, AMF 312, and/or SMF 314.Based on the collected data, NWDAF 390 may provide load level data tothe PCF 320 and/or NSSF 370, and/or notify the PC 220 and/or NSSF 370 ifload level for a slice reaches and/or exceeds a load level threshold.

The AF 399 may be outside the core network, but may interact with thecore network to provide information relating to the QoS requirements ortraffic routing preferences associated with a particular application.The AF 399 may access the core network based on the exposure constraintsimposed by the NEF 340. However, an operator of the core network mayconsider the AF 399 to be a trusted domain that can access the networkdirectly.

FIGS. 4A, 4B, and 5 illustrate other examples of core networkarchitectures that are analogous in some respects to the core networkarchitecture 300 depicted in FIG. 3 . For conciseness, some of the corenetwork elements depicted in FIG. 3 are omitted. Many of the elementsdepicted in FIGS. 4A, 4B, and 5 are analogous in some respects toelements depicted in FIG. 3 . For conciseness, some of the detailsrelating to their functions or operation are omitted.

FIG. 4A illustrates an example of a core network architecture 400Acomprising an arrangement of multiple UPFs. Core network architecture400A includes a UE 401, an AN 402, an AMF 412, and an SMF 414. Unlikeprevious examples of core network architectures described above, FIG. 4Adepicts multiple UPFs, including a UPF 405, a UPF 406, and a UPF 407,and multiple DNs, including a DN 408 and a DN 409. Each of the multipleUPFs 405, 406, 407 may communicate with the SMF 414 via an N4 interface.The DNs 408, 409 communicate with the UPFs 405, 406, respectively, viaN6 interfaces. As shown in FIG. 4A, the multiple UPFs 405, 406, 407 maycommunicate with one another via N9 interfaces.

The UPFs 405, 406, 407 may perform traffic detection, in which the UPFsidentify and/or classify packets. Packet identification may be performedbased on packet detection rules (PDR) provided by the SMF 414. A PDR mayinclude packet detection information comprising one or more of: a sourceinterface, a UE IP address, core network (CN) tunnel information (e.g.,a CN address of an N3/N9 tunnel corresponding to a PDU session), anetwork instance identifier, a quality of service flow identifier (QFI),a filter set (for example, an IP packet filter set or an ethernet packetfilter set), and/or an application identifier.

In addition to indicating how a particular packet is to be detected, aPDR may further indicate rules for handling the packet upon detectionthereof. The rules may include, for example, forwarding action rules(FARs), multi-access rules (MARs), usage reporting rules (URRs), QoSenforcement rules (QERs), etc. For example, the PDR may comprise one ormore FAR identifiers, MAR identifiers, URR identifiers, and/or QERidentifiers. These identifiers may indicate the rules that areprescribed for the handling of a particular detected packet.

The UPF 405 may perform traffic forwarding in accordance with a FAR. Forexample, the FAR may indicate that a packet associated with a particularPDR is to be forwarded, duplicated, dropped, and/or buffered. The FARmay indicate a destination interface, for example, “access” for downlinkor “core” for uplink. If a packet is to be buffered, the FAR mayindicate a buffering action rule (BAR). As an example, UPF 405 mayperform data buffering of a certain number downlink packets if a PDUsession is deactivated.

The UPF 405 may perform QoS enforcement in accordance with a QER. Forexample, the QER may indicate a guaranteed bitrate that is authorizedand/or a maximum bitrate to be enforced for a packet associated with aparticular PDR. The QER may indicate that a particular guaranteed and/ormaximum bitrate may be for uplink packets and/or downlink packets. TheUPF 405 may mark packets belonging to a particular QoS flow with acorresponding QFI. The marking may enable a recipient of the packet todetermine a QoS of the packet.

The UPF 405 may provide usage reports to the SMF 414 in accordance witha URR. The URR may indicate one or more triggering conditions forgeneration and reporting of the usage report, for example, immediatereporting, periodic reporting, a threshold for incoming uplink traffic,or any other suitable triggering condition. The URR may indicate amethod for measuring usage of network resources, for example, datavolume, duration, and/or event.

As noted above, the DNs 408, 409 may comprise public DNs (e.g., theInternet), private DNs (e.g., private, internal corporate-owned DNs),and/or intra-operator DNs. Each DN may provide an operator serviceand/or a third-party service. The service provided by a DN may be theInternet, an IP multimedia subsystem (IMS), an augmented or virtualreality network, an edge computing or mobile edge computing (MEC)network, etc. Each DN may be identified using a data network name (DNN).The UE 401 may be configured to establish a first logical connectionwith DN 408 (a first PDU session), a second logical connection with DN409 (a second PDU session), or both simultaneously (first and second PDUsessions).

Each PDU session may be associated with at least one UPF configured tooperate as a PDU session anchor (PSA, or “anchor”). The anchor may be aUPF that provides an N6 interface with a DN.

In the example of FIG. 4A, UPF 405 may be the anchor for the first PDUsession between UE 401 and DN 408, whereas the UPF 406 may be the anchorfor the second PDU session between UE 401 and DN 409. The core networkmay use the anchor to provide service continuity of a particular PDUsession (for example, IP address continuity) as UE 401 moves from oneaccess network to another. For example, suppose that UE 401 establishesa PDU session using a data path to the DN 408 using an access networkother than AN 402. The data path may include UPF 405 acting as anchor.Suppose further that the UE 401 later moves into the coverage area ofthe AN 402. In such a scenario, SMF 414 may select a new UPF (UPF 407)to bridge the gap between the newly-entered access network (AN 402) andthe anchor UPF (UPF 405). The continuity of the PDU session may bepreserved as any number of UPFs are added or removed from the data path.When a UPF is added to a data path, as shown in FIG. 4A, it may bedescribed as an intermediate UPF and/or a cascaded UPF.

As noted above, UPF 406 may be the anchor for the second PDU sessionbetween UE 401 and DN 409. Although the anchor for the first and secondPDU sessions are associated with different UPFs in FIG. 4A, it will beunderstood that this is merely an example. It will also be understoodthat multiple PDU sessions with a single DN may correspond to any numberof anchors. When there are multiple UPFs, a UPF at the branching point(UPF 407 in FIG. 4 ) may operate as an uplink classifier (UL-CL). TheUL-CL may divert uplink user plane traffic to different UPFs.

The SMF 414 may allocate, manage, and/or assign an IP address to UE 401,for example, upon establishment of a PDU session. The SMF 414 maymaintain an internal pool of IP addresses to be assigned. The SMF 414may, if necessary, assign an IP address provided by a dynamic hostconfiguration protocol (DHCP) server or an authentication,authorization, and accounting (AAA) server. IP address management may beperformed in accordance with a session and service continuity (SSC)mode. In SSC mode 1, an IP address of UE 401 may be maintained (and thesame anchor UPF may be used) as the wireless device moves within thenetwork. In SSC mode 2, the IP address of UE 401 changes as UE 401 moveswithin the network (e.g., the old IP address and UPF may be abandonedand a new IP address and anchor UPF may be established). In SSC mode 3,it may be possible to maintain an old IP address (similar to SSC mode 1)temporarily while establishing a new IP address (similar to SSC mode 2),thus combining features of SSC modes 1 and 2. Applications that aresensitive to IP address changes may operate in accordance with SSC mode1.

UPF selection may be controlled by SMF 414. For example, uponestablishment and/or modification of a PDU session between UE 401 and DN408, SMF 414 may select UPF 405 as the anchor for the PDU session and/orUPF 407 as an intermediate UPF. Criteria for UPF selection include pathefficiency and/or speed between AN 402 and DN 408. The reliability, loadstatus, location, slice support and/or other capabilities of candidateUPFs may also be considered.

FIG. 4B illustrates an example of a core network architecture 400B thataccommodates untrusted access. Similar to FIG. 4A, UE 401 as depicted inFIG. 4B connects to DN 408 via AN 402 and UPF 405. The AN 402 and UPF405 constitute trusted (e.g., 3GPP) access to the DN 408. By contrast,UE 401 may also access DN 408 using an untrusted access network, AN 403,and a non-3GPP interworking function (N3IWF) 404.

The AN 403 may be, for example, a wireless land area network (WLAN)operating in accordance with the IEEE 802.11 standard. The UE 401 mayconnect to AN 403, via an interface Y1, in whatever manner is prescribedfor AN 403. The connection to AN 403 may or may not involveauthentication. The UE 401 may obtain an IP address from AN 403. The UE401 may determine to connect to core network 400B and select untrustedaccess for that purpose. The AN 403 may communicate with N3IWF 404 via aY2 interface. After selecting untrusted access, the UE 401 may provideN3IWF 404 with sufficient information to select an AMF. The selected AMFmay be, for example, the same AMF that is used by UE 401 for 3GPP access(AMF 412 in the present example). The N3IWF 404 may communicate with AMF412 via an N2 interface. The UPF 405 may be selected and N3IWF 404 maycommunicate with UPF 405 via an N3 interface. The UPF 405 may be a PDUsession anchor (PSA) and may remain the anchor for the PDU session evenas UE 401 shifts between trusted access and untrusted access.

FIG. 5 illustrates an example of a core network architecture 500 inwhich a UE 501 is in a roaming scenario. In a roaming scenario, UE 501is a subscriber of a first PLMN (a home PLMN, or HPLMN) but attaches toa second PLMN (a visited PLMN, or VPLMN). Core network architecture 500includes UE 501, an AN 502, a UPF 505, and a DN 508. The AN 502 and UPF505 may be associated with a VPLMN. The VPLMN may manage the AN 502 andUPF 505 using core network elements associated with the VPLMN, includingan AMF 512, an SMF 514, a PCF 520, an NRF 530, an NEF 540, and an NSSF570. An AF 599 may be adjacent the core network of the VPLMN.

The UE 501 may not be a subscriber of the VPLMN. The AMF 512 mayauthorize UE 501 to access the network based on, for example, roamingrestrictions that apply to UE 501. In order to obtain network servicesprovided by the VPLMN, it may be necessary for the core network of theVPLMN to interact with core network elements of a HPLMN of UE 501, inparticular, a PCF 521, an NRF 531, an NEF 541, a UDM 551, and/or an AUSF561. The VPLMN and HPLMN may communicate using an N32 interfaceconnecting respective security edge protection proxies (SEPPs). In FIG.5 , the respective SEPPs are depicted as a VSEPP 590 and an HSEPP 591.

The VSEPP 590 and the HSEPP 591 communicate via an N32 interface fordefined purposes while concealing information about each PLMN from theother. The SEPPs may apply roaming policies based on communications viathe N32 interface. The PCF 520 and PCF 521 may communicate via the SEPPsto exchange policy-related signaling. The NRF 530 and NRF 531 maycommunicate via the SEPPs to enable service discovery of NFs in therespective PLMNs. The VPLMN and HPLMN may independently maintain NEF 540and NEF 541. The NSSF 570 and NSSF 571 may communicate via the SEPPs tocoordinate slice selection for UE 501. The HPLMN may handle allauthentication and subscription related signaling. For example, when theUE 501 registers or requests service via the VPLMN, the VPLMN mayauthenticate UE 501 and/or obtain subscription data of UE 501 byaccessing, via the SEPPs, the UDM 551 and AUSF 561 of the HPLMN.

The core network architecture 500 depicted in FIG. 5 may be referred toas a local breakout configuration, in which UE 501 accesses DN 508 usingone or more UPFs of the VPLMN (i.e., UPF 505). However, otherconfigurations are possible. For example, in a home-routed configuration(not shown in FIG. 5 ), UE 501 may access a DN using one or more UPFs ofthe HPLMN. In the home-routed configuration, an N9 interface may runparallel to the N32 interface, crossing the frontier between the VPLMNand the HPLMN to carry user plane data. One or more SMFs of therespective PLMNs may communicate via the N32 interface to coordinatesession management for UE 501. The SMFs may control their respectiveUPFs on either side of the frontier.

FIG. 6 illustrates an example of network slicing. Network slicing mayrefer to division of shared infrastructure (e.g., physicalinfrastructure) into distinct logical networks. These distinct logicalnetworks may be independently controlled, isolated from one another,and/or associated with dedicated resources.

Network architecture 600A illustrates an un-sliced physical networkcorresponding to a single logical network. The network architecture 600Acomprises a user plane wherein UEs 601A, 601B, 601C (collectively, UEs601) have a physical and logical connection to a DN 608 via an AN 602and a UPF 605. The network architecture 600A comprises a control planewherein an AMF 612 and a SMF 614 control various aspects of the userplane.

The network architecture 600A may have a specific set of characteristics(e.g., relating to maximum bit rate, reliability, latency, bandwidthusage, power consumption, etc.). This set of characteristics may beaffected by the nature of the network elements themselves (e.g.,processing power, availability of free memory, proximity to othernetwork elements, etc.) or the management thereof (e.g., optimized tomaximize bit rate or reliability, reduce latency or power bandwidthusage, etc.). The characteristics of network architecture 600A maychange over time, for example, by upgrading equipment or by modifyingprocedures to target a particular characteristic. However, at any giventime, network architecture 600A will have a single set ofcharacteristics that may or may not be optimized for a particular usecase. For example, UEs 601A, 601B, 601C may have different requirements,but network architecture 600A can only be optimized for one of thethree.

Network architecture 600B is an example of a sliced physical networkdivided into multiple logical networks. In FIG. 6 , the physical networkis divided into three logical networks, referred to as slice A, slice B,and slice C. For example, UE 601A may be served by AN 602A, UPF 605A,AMF 612, and SMF 614A. UE 601B may be served by AN 602B, UPF 605B, AMF612, and SMF 614B. UE 601C may be served by AN 602C, UPF 605C, AMF 612,and SMF 614C. Although the respective UEs 601 communicate with differentnetwork elements from a logical perspective, these network elements maybe deployed by a network operator using the same physical networkelements.

Each network slice may be tailored to network services having differentsets of characteristics. For example, slice A may correspond to enhancedmobile broadband (eMBB) service. Mobile broadband may refer to internetaccess by mobile users, commonly associated with smartphones. Slice Bmay correspond to ultra-reliable low-latency communication (URLLC),which focuses on reliability and speed. Relative to eMBB, URLLC mayimprove the feasibility of use cases such as autonomous driving andtelesurgery. Slice C may correspond to massive machine typecommunication (mMTC), which focuses on low-power services delivered to alarge number of users. For example, slice C may be optimized for a densenetwork of battery-powered sensors that provide small amounts of data atregular intervals. Many mMTC use cases would be prohibitively expensiveif they operated using an eMBB or URLLC network.

If the service requirements for one of the UEs 601 changes, then thenetwork slice serving that UE can be updated to provide better service.Moreover, the set of network characteristics corresponding to eMBB,URLLC, and mMTC may be varied, such that differentiated species of eMBB,URLLC, and mMTC are provided. Alternatively, network operators mayprovide entirely new services in response to, for example, customerdemand.

In FIG. 6 , each of the UEs 601 has its own network slice. However, itwill be understood that a single slice may serve any number of UEs and asingle UE may operate using any number of slices. Moreover, in theexample network architecture 600B, the AN 602, UPF 605 and SMF 614 areseparated into three separate slices, whereas the AMF 612 is unsliced.However, it will be understood that a network operator may deploy anyarchitecture that selectively utilizes any mix of sliced and unslicednetwork elements, with different network elements divided into differentnumbers of slices. Although FIG. 6 only depicts three core networkfunctions, it will be understood that other core network functions maybe sliced as well. A PLMN that supports multiple network slices maymaintain a separate network repository function (NFR) for each slice,enabling other NFs to discover network services associated with thatslice.

Network slice selection may be controlled by an AMF, or alternatively,by a separate network slice selection function (NSSF). For example, anetwork operator may define and implement distinct network sliceinstances (NSIs). Each NSI may be associated with single network sliceselection assistance information (S-NSSAI). The S-NSSAI may include aparticular slice/service type (SST) indicator (indicating eMBB, URLLC,mMTC, etc.). as an example, a particular tracking area may be associatedwith one or more configured S-NSSAIs. UEs may identify one or morerequested and/or subscribed S-NSSAIs (e.g., during registration). Thenetwork may indicate to the UE one or more allowed and/or rejectedS-NSSAIs.

The S-NSSAI may further include a slice differentiator (SD) todistinguish between different tenants of a particular slice and/orservice type. For example, a tenant may be a customer (e.g., vehiclemanufacture, service provider, etc.) of a network operator that obtains(for example, purchases) guaranteed network resources and/or specificpolicies for handling its subscribers. The network operator mayconfigure different slices and/or slice types, and use the SD todetermine which tenant is associated with a particular slice.

FIG. 7A, FIG. 7B, and FIG. 7C illustrate a user plane (UP) protocolstack, a control plane (CP) protocol stack, and services providedbetween protocol layers of the UP protocol stack.

The layers may be associated with an open system interconnection (OSI)model of computer networking functionality. In the OSI model, layer 1may correspond to the bottom layer, with higher layers on top of thebottom layer. Layer 1 may correspond to a physical layer, which isconcerned with the physical infrastructure used for transfer of signals(for example, cables, fiber optics, and/or radio frequencytransceivers). In New Radio (NR), layer 1 may comprise a physical layer(PHY). Layer 2 may correspond to a data link layer. Layer 2 may beconcerned with packaging of data (into, e.g., data frames) for transfer,between nodes of the network, using the physical infrastructure oflayer 1. In NR, layer 2 may comprise a media access control layer (MAC),a radio link control layer (RLC), a packet data convergence layer(PDCP), and a service data application protocol layer (SDAP).

Layer 3 may correspond to a network layer. Layer 3 may be concerned withrouting of the data which has been packaged in layer 2. Layer 3 mayhandle prioritization of data and traffic avoidance. In NR, layer 3 maycomprise a radio resource control layer (RRC) and a non-access stratumlayer (NAS). Layers 4 through 7 may correspond to a transport layer, asession layer, a presentation layer, and an application layer. Theapplication layer interacts with an end user to provide data associatedwith an application. In an example, an end user implementing theapplication may generate data associated with the application andinitiate sending of that information to a targeted data network (e.g.,the Internet, an application server, etc.). Starting at the applicationlayer, each layer in the OSI model may manipulate and/or repackage theinformation and deliver it to a lower layer. At the lowest layer, themanipulated and/or repackaged information may be exchanged via physicalinfrastructure (for example, electrically, optically, and/orelectromagnetically). As it approaches the targeted data network, theinformation will be unpackaged and provided to higher and higher layers,until it once again reaches the application layer in a form that isusable by the targeted data network (e.g., the same form in which it wasprovided by the end user). To respond to the end user, the data networkmay perform this procedure in reverse.

FIG. 7A illustrates a user plane protocol stack. The user plane protocolstack may be a new radio (NR) protocol stack for a Uu interface betweena UE 701 and a gNB 702. In layer 1 of the UP protocol stack, the UE 701may implement PHY 731 and the gNB 702 may implement PHY 732. In layer 2of the UP protocol stack, the UE 701 may implement MAC 741, RLC 751,PDCP 761, and SDAP 771. The gNB 702 may implement MAC 742, RLC 752, PDCP762, and SDAP 772.

FIG. 7B illustrates a control plane protocol stack. The control planeprotocol stack may be an NR protocol stack for the Uu interface betweenthe UE 701 and the gNB 702 and/or an N1 interface between the UE 701 andan AMF 712. In layer 1 of the CP protocol stack, the UE 701 mayimplement PHY 731 and the gNB 702 may implement PHY 732. In layer 2 ofthe CP protocol stack, the UE 701 may implement MAC 741, RLC 751, PDCP761, RRC 781, and NAS 791. The gNB 702 may implement MAC 742, RLC 752,PDCP 762, and RRC 782. The AMF 712 may implement NAS 792.

The NAS may be concerned with the non-access stratum, in particular,communication between the UE 701 and the core network (e.g., the AMF712). Lower layers may be concerned with the access stratum, forexample, communication between the UE 701 and the gNB 702. Messages sentbetween the UE 701 and the core network may be referred to as NASmessages. In an example, a NAS message may be relayed by the gNB 702,but the content of the NAS message (e.g., information elements of theNAS message) may not be visible to the gNB 702.

FIG. 7C illustrates an example of services provided between protocollayers of the NR user plane protocol stack illustrated in FIG. 7A. TheUE 701 may receive services through a PDU session, which may be alogical connection between the UE 701 and a data network (DN). The UE701 and the DN may exchange data packets associated with the PDUsession. The PDU session may comprise one or more quality of service(QoS) flows. SDAP 771 and SDAP 772 may perform mapping and/or demappingbetween the one or more QoS flows of the PDU session and one or moreradio bearers (e.g., data radio bearers). The mapping between the QoSflows and the data radio bearers may be determined in the SDAP 772 bythe gNB 702, and the UE 701 may be notified of the mapping (e.g., basedon control signaling and/or reflective mapping). For reflective mapping,the SDAP 772 of the gNB 220 may mark downlink packets with a QoS flowindicator (QFI) and deliver the downlink packets to the UE 701. The UE701 may determine the mapping based on the QFI of the downlink packets.

PDCP 761 and PDCP 762 may perform header compression and/ordecompression. Header compression may reduce the amount of datatransmitted over the physical layer. The PDCP 761 and PDCP 762 mayperform ciphering and/or deciphering. Ciphering may reduce unauthorizeddecoding of data transmitted over the physical layer (e.g., interceptedon an air interface), and protect data integrity (e.g., to ensurecontrol messages originate from intended sources). The PDCP 761 and PDCP762 may perform retransmissions of undelivered packets, in-sequencedelivery and reordering of packets, duplication of packets, and/oridentification and removal of duplicate packets. In a dual connectivityscenario, PDCP 761 and PDCP 762 may perform mapping between a splitradio bearer and RLC channels.

RLC 751 and RLC 752 may perform segmentation, retransmission throughAutomatic Repeat Request (ARQ). The RLC 751 and RLC 752 may performremoval of duplicate data units received from MAC 741 and MAC 742,respectively. The RLCs 213 and 223 may provide RLC channels as a serviceto PDCPs 214 and 224, respectively.

MAC 741 and MAC 742 may perform multiplexing and/or demultiplexing oflogical channels. MAC 741 and MAC 742 may map logical channels totransport channels. In an example, UE 701 may, in MAC 741, multiplexdata units of one or more logical channels into a transport block. TheUE 701 may transmit the transport block to the gNB 702 using PHY 731.The gNB 702 may receive the transport block using PHY 732 anddemultiplex data units of the transport blocks back into logicalchannels. MAC 741 and MAC 742 may perform error correction throughHybrid Automatic Repeat Request (HARM), logical channel prioritization,and/or padding.

PHY 731 and PHY 732 may perform mapping of transport channels tophysical channels. PHY 731 and PHY 732 may perform digital and analogsignal processing functions (e.g., coding/decoding andmodulation/demodulation) for sending and receiving information (e.g.,transmission via an air interface). PHY 731 and PHY 732 may performmulti-antenna mapping.

FIG. 8 illustrates an example of a quality of service (QoS) model fordifferentiated data exchange. In the QoS model of FIG. 8 , there are aUE 801, a AN 802, and a UPF 805. The QoS model facilitatesprioritization of certain packet or protocol data units (PDUs), alsoreferred to as packets. For example, higher-priority packets may beexchanged faster and/or more reliably than lower-priority packets. Thenetwork may devote more resources to exchange of high-QoS packets.

In the example of FIG. 8 , a PDU session 810 is established between UE801 and UPF 805. The PDU session 810 may be a logical connectionenabling the UE 801 to exchange data with a particular data network (forexample, the Internet). The UE 801 may request establishment of the PDUsession 810. At the time that the PDU session 810 is established, the UE801 may, for example, identify the targeted data network based on itsdata network name (DNN). The PDU session 810 may be managed, forexample, by a session management function (SMF, not shown). In order tofacilitate exchange of data associated with the PDU session 810, betweenthe UE 801 and the data network, the SMF may select the UPF 805 (andoptionally, one or more other UPFs, not shown).

One or more applications associated with UE 801 may generate uplinkpackets 812A-812E associated with the PDU session 810. In order to workwithin the QoS model, UE 801 may apply QoS rules 814 to uplink packets812A-812E. The QoS rules 814 may be associated with PDU session 810 andmay be determined and/or provided to the UE 801 when PDU session 810 isestablished and/or modified. Based on QoS rules 814, UE 801 may classifyuplink packets 812A-812E, map each of the uplink packets 812A-812E to aQoS flow, and/or mark uplink packets 812A-812E with a QoS flow indicator(QFI). As a packet travels through the network, and potentially mixeswith other packets from other UEs having potentially differentpriorities, the QFI indicates how the packet should be handled inaccordance with the QoS model. In the present illustration, uplinkpackets 812A, 812B are mapped to QoS flow 816A, uplink packet 812C ismapped to QoS flow 816B, and the remaining packets are mapped to QoSflow 816C.

The QoS flows may be the finest granularity of QoS differentiation in aPDU session. In the figure, three QoS flows 816A-816C are illustrated.However, it will be understood that there may be any number of QoSflows. Some QoS flows may be associated with a guaranteed bit rate (GBRQoS flows) and others may have bit rates that are not guaranteed(non-GBR QoS flows). QoS flows may also be subject to per-UE andper-session aggregate bit rates. One of the QoS flows may be a defaultQoS flow. The QoS flows may have different priorities. For example, QoSflow 816A may have a higher priority than QoS flow 816B, which may havea higher priority than QoS flow 816C. Different priorities may bereflected by different QoS flow characteristics. For example, QoS flowsmay be associated with flow bit rates. A particular QoS flow may beassociated with a guaranteed flow bit rate (GFBR) and/or a maximum flowbit rate (MFBR). QoS flows may be associated with specific packet delaybudgets (PDBs), packet error rates (PERs), and/or maximum packet lossrates. QoS flows may also be subject to per-UE and per-session aggregatebit rates.

In order to work within the QoS model, UE 801 may apply resource mappingrules 818 to the QoS flows 816A-816C. The air interface between UE 801and AN 802 may be associated with resources 820. In the presentillustration, QoS flow 816A is mapped to resource 820A, whereas QoSflows 816B, 816C are mapped to resource 820B. The resource mapping rules818 may be provided by the AN 802. In order to meet QoS requirements,the resource mapping rules 818 may designate more resources forrelatively high-priority QoS flows. With more resources, a high-priorityQoS flow such as QoS flow 816A may be more likely to obtain the highflow bit rate, low packet delay budget, or other characteristicassociated with QoS rules 814. The resources 820 may comprise, forexample, radio bearers. The radio bearers (e.g., data radio bearers) maybe established between the UE 801 and the AN 802. The radio bearers in5G, between the UE 801 and the AN 802, may be distinct from bearers inLTE, for example, Evolved Packet System (EPS) bearers between a UE and apacket data network gateway (PGW), 51 bearers between an eNB and aserving gateway (SGW), and/or an S5/S8 bearer between an SGW and a PGW.

Once a packet associated with a particular QoS flow is received at AN802 via resource 820A or resource 820B, AN 802 may separate packets intorespective QoS flows 856A-856C based on QoS profiles 828. The QoSprofiles 828 may be received from an SMF. Each QoS profile maycorrespond to a QFI, for example, the QFI marked on the uplink packets812A-812E. Each QoS profile may include QoS parameters such as 5G QoSidentifier (5QI) and an allocation and retention priority (ARP). The QoSprofile for non-GBR QoS flows may further include additional QoSparameters such as a reflective QoS attribute (RQA). The QoS profile forGBR QoS flows may further include additional QoS parameters such as aguaranteed flow bit rate (GFBR), a maximum flow bit rate (MFBR), and/ora maximum packet loss rate. The 5QI may be a standardized 5QI which haveone-to-one mapping to a standardized combination of 5G QoScharacteristics per well-known services. The 5QI may be a dynamicallyassigned 5QI which the standardized 5QI values are not defined. The 5QImay represent 5G QoS characteristics. The 5QI may comprise a resourcetype, a default priority level, a packet delay budget (PDB), a packeterror rate (PER), a maximum data burst volume, and/or an averagingwindow. The resource type may indicate a non-GBR QoS flow, a GBR QoSflow or a delay-critical GBR QoS flow. The averaging window mayrepresent a duration over which the GFBR and/or MFBR is calculated. ARPmay be a priority level comprising pre-emption capability and apre-emption vulnerability. Based on the ARP, the AN 802 may applyadmission control for the QoS flows in a case of resource limitations.

The AN 802 may select one or more N3 tunnels 850 for transmission of theQoS flows 856A-856C. After the packets are divided into QoS flows856A-856C, the packet may be sent to UPF 805 (e.g., towards a DN) viathe selected one or more N3 tunnels 850. The UPF 805 may verify that theQFIs of the uplink packets 812A-812E are aligned with the QoS rules 814provided to the UE 801. The UPF 805 may measure and/or count packetsand/or provide packet metrics to, for example, a PCF.

The figure also illustrates a process for downlink. In particular, oneor more applications may generate downlink packets 852A-852E. The UPF805 may receive downlink packets 852A-852E from one or more DNs and/orone or more other UPFs. As per the QoS model, UPF 805 may apply packetdetection rules (PDRs) 854 to downlink packets 852A-852E. Based on PDRs854, UPF 805 may map packets 852A-852E into QoS flows. In the presentillustration, downlink packets 852A, 852B are mapped to QoS flow 856A,downlink packet 852C is mapped to QoS flow 856B, and the remainingpackets are mapped to QoS flow 856C.

The QoS flows 856A-856C may be sent to AN 802. The AN 802 may applyresource mapping rules to the QoS flows 856A-856C. In the presentillustration, QoS flow 856A is mapped to resource 820A, whereas QoSflows 856B, 856C are mapped to resource 820B. In order to meet QoSrequirements, the resource mapping rules may designate more resources tohigh-priority QoS flows.

FIGS. 9A-9D illustrate example states and state transitions of awireless device (e.g., a UE). At any given time, the wireless device mayhave a radio resource control (RRC) state, a registration management(RM) state, and a connection management (CM) state.

FIG. 9A is an example diagram showing RRC state transitions of awireless device (e.g., a UE). The UE may be in one of three RRC states:RRC idle 910, (e.g., RRC_IDLE), RRC inactive 920 (e.g., RRC_INACTIVE),or RRC connected 930 (e.g., RRC_CONNECTED). The UE may implementdifferent RAN-related control-plane procedures depending on its RRCstate. Other elements of the network, for example, a base station, maytrack the RRC state of one or more UEs and implement RAN-relatedcontrol-plane procedures appropriate to the RRC state of each.

In RRC connected 930, it may be possible for the UE to exchange datawith the network (for example, the base station). The parametersnecessary for exchange of data may be established and known to both theUE and the network. The parameters may be referred to and/or included inan RRC context of the UE (sometimes referred to as a UE context). Theseparameters may include, for example: one or more AS contexts; one ormore radio link configuration parameters; bearer configurationinformation (e.g., relating to a data radio bearer, signaling radiobearer, logical channel, QoS flow, and/or PDU session); securityinformation; and/or PHY, MAC, RLC, PDCP, and/or SDAP layer configurationinformation. The base station with which the UE is connected may storethe RRC context of the UE.

While in RRC connected 930, mobility of the UE may be managed by theaccess network, whereas the UE itself may manage mobility while in RRCidle 910 and/or RRC inactive 920. While in RRC connected 930, the UE maymanage mobility by measuring signal levels (e.g., reference signallevels) from a serving cell and neighboring cells and reporting thesemeasurements to the base station currently serving the UE. The networkmay initiate handover based on the reported measurements. The RRC statemay transition from RRC connected 930 to RRC idle 910 through aconnection release procedure 930 or to RRC inactive 920 through aconnection inactivation procedure 932.

In RRC idle 910, an RRC context may not be established for the UE. InRRC idle 910, the UE may not have an RRC connection with a base station.While in RRC idle 910, the UE may be in a sleep state for a majority ofthe time (e.g., to conserve battery power). The UE may wake upperiodically (e.g., once in every discontinuous reception cycle) tomonitor for paging messages from the access network. Mobility of the UEmay be managed by the UE through a procedure known as cell reselection.The RRC state may transition from RRC idle 910 to RRC connected 930through a connection establishment procedure 913, which may involve arandom access procedure, as discussed in greater detail below.

In RRC inactive 920, the RRC context previously established ismaintained in the UE and the base station. This may allow for a fasttransition to RRC connected 930 with reduced signaling overhead ascompared to the transition from RRC idle 910 to RRC connected 930. TheRRC state may transition to RRC connected 930 through a connectionresume procedure 923. The RRC state may transition to RRC idle 910though a connection release procedure 921 that may be the same as orsimilar to connection release procedure 931.

An RRC state may be associated with a mobility management mechanism. InRRC idle 910 and RRC inactive 920, mobility may be managed by the UEthrough cell reselection. The purpose of mobility management in RRC idle910 and/or RRC inactive 920 is to allow the network to be able to notifythe UE of an event via a paging message without having to broadcast thepaging message over the entire mobile communications network. Themobility management mechanism used in RRC idle 910 and/or RRC inactive920 may allow the network to track the UE on a cell-group level so thatthe paging message may be broadcast over the cells of the cell groupthat the UE currently resides within instead of the entire communicationnetwork. Tracking may be based on different granularities of grouping.For example, there may be three levels of cell-grouping granularity:individual cells; cells within a RAN area identified by a RAN areaidentifier (RAI); and cells within a group of RAN areas, referred to asa tracking area and identified by a tracking area identifier (TAI).

Tracking areas may be used to track the UE at the CN level. The CN mayprovide the UE with a list of TAIs associated with a UE registrationarea. If the UE moves, through cell reselection, to a cell associatedwith a TAI not included in the list of TAIs associated with the UEregistration area, the UE may perform a registration update with the CNto allow the CN to update the UE's location and provide the UE with anew the UE registration area.

RAN areas may be used to track the UE at the RAN level. For a UE in RRCinactive 920 state, the UE may be assigned a RAN notification area. ARAN notification area may comprise one or more cell identities, a listof RAIs, and/or a list of TAIs. In an example, a base station may belongto one or more RAN notification areas. In an example, a cell may belongto one or more RAN notification areas. If the UE moves, through cellreselection, to a cell not included in the RAN notification areaassigned to the UE, the UE may perform a notification area update withthe RAN to update the UE's RAN notification area.

A base station storing an RRC context for a UE or a last serving basestation of the UE may be referred to as an anchor base station. Ananchor base station may maintain an RRC context for the UE at leastduring a period of time that the UE stays in a RAN notification area ofthe anchor base station and/or during a period of time that the UE staysin RRC inactive 920.

FIG. 9B is an example diagram showing registration management (RM) statetransitions of a wireless device (e.g., a UE). The states are RMderegistered 940, (e.g., RM-DEREGISTERED) and RM registered 950 (e.g.,RM-REGISTERED).

In RM deregistered 940, the UE is not registered with the network, andthe UE is not reachable by the network. In order to be reachable by thenetwork, the UE must perform an initial registration. As an example, theUE may register with an AMF of the network. If registration is rejected(registration reject 944), then the UE remains in RM deregistered 940.If registration is accepted (registration accept 945), then the UEtransitions to RM registered 950. While the UE is RM registered 950, thenetwork may store, keep, and/or maintain a UE context for the UE. The UEcontext may be referred to as wireless device context. The UE contextcorresponding to network registration (maintained by the core network)may be different from the RRC context corresponding to RRC state(maintained by an access network, .e.g., a base station). The UE contextmay comprise a UE identifier and a record of various informationrelating to the UE, for example, UE capability information, policyinformation for access and mobility management of the UE, lists ofallowed or established slices or PDU sessions, and/or a registrationarea of the UE (i.e., a list of tracking areas covering the geographicalarea where the wireless device is likely to be found).

While the UE is RM registered 950, the network may store the UE contextof the UE, and if necessary use the UE context to reach the UE.Moreover, some services may not be provided by the network unless the UEis registered. The UE may update its UE context while remaining in RMregistered 950 (registration update accept 955). For example, if the UEleaves one tracking area and enters another tracking area, the UE mayprovide a tracking area identifier to the network. The network mayderegister the UE, or the UE may deregister itself (deregistration 954).For example, the network may automatically deregister the wirelessdevice if the wireless device is inactive for a certain amount of time.Upon deregistration, the UE may transition to RM deregistered 940.

FIG. 9C is an example diagram showing connection management (CM) statetransitions of a wireless device (e.g., a UE), shown from a perspectiveof the wireless device. The UE may be in CM idle 960 (e.g., CM-IDLE) orCM connected 970 (e.g., CM-CONNECTED).

In CM idle 960, the UE does not have a non access stratum (NAS)signaling connection with the network. As a result, the UE can notcommunicate with core network functions. The UE may transition to CMconnected 970 by establishing an AN signaling connection (AN signalingconnection establishment 967). This transition may be initiated bysending an initial NAS message. The initial NAS message may be aregistration request (e.g., if the UE is RM deregistered 940) or aservice request (e.g., if the UE is RM registered 950). If the UE is RMregistered 950, then the UE may initiate the AN signaling connectionestablishment by sending a service request, or the network may send apage, thereby triggering the UE to send the service request.

In CM connected 970, the UE can communicate with core network functionsusing NAS signaling. As an example, the UE may exchange NAS signalingwith an AMF for registration management purposes, service requestprocedures, and/or authentication procedures. As another example, the UEmay exchange NAS signaling, with an SMF, to establish and/or modify aPDU session. The network may disconnect the UE, or the UE may disconnectitself (AN signaling connection release 976). For example, if the UEtransitions to RM deregistered 940, then the UE may also transition toCM idle 960. When the UE transitions to CM idle 960, the network maydeactivate a user plane connection of a PDU session of the UE.

FIG. 9D is an example diagram showing CM state transitions of thewireless device (e.g., a UE), shown from a network perspective (e.g., anAMF). The CM state of the UE, as tracked by the AMF, may be in CM idle980 (e.g., CM-IDLE) or CM connected 990 (e.g., CM-CONNECTED). When theUE transitions from CM idle 980 to CM connected 990, the AMF manyestablish an N2 context of the UE (N2 context establishment 989). Whenthe UE transitions from CM connected 990 to CM idle 980, the AMF manyrelease the N2 context of the UE (N2 context release 998).

FIGS. 10-12 illustrate example procedures for registering, servicerequest, and PDU session establishment of a UE.

FIG. 10 illustrates an example of a registration procedure for awireless device (e.g., a UE). Based on the registration procedure, theUE may transition from, for example, RM deregistered 940 to RMregistered 950.

Registration may be initiated by a UE for the purposes of obtainingauthorization to receive services, enabling mobility tracking, enablingreachability, or other purposes. The UE may perform an initialregistration as a first step toward connection to the network (forexample, if the UE is powered on, airplane mode is turned off, etc.).Registration may also be performed periodically to keep the networkinformed of the UE's presence (for example, while in CM-IDLE state), orin response to a change in UE capability or registration area.Deregistration (not shown in FIG. 10 ) may be performed to stop networkaccess.

At 1010, the UE transmits a registration request to an AN. As anexample, the UE may have moved from a coverage area of a previous AMF(illustrated as AMF #1) into a coverage area of a new AMF (illustratedas AMF #2). The registration request may be a NAS message. Theregistration request may include a UE identifier. The AN may select anAMF for registration of the UE. For example, the AN may select a defaultAMF. For example, the AN may select an AMF that is already mapped to theUE (e.g., a previous AMF). The NAS registration request may include anetwork slice identifier and the AN may select an AMF based on therequested slice. After the AMF is selected, the AN may send theregistration request to the selected AMF.

At 1020, the AMF that receives the registration request (AMF #2)performs a context transfer. The context may be a UE context, forexample, an RRC context for the UE. As an example, AMF #2 may send AMF#1 a message requesting a context of the UE. The message may include theUE identifier. The message may be a Namf_Communication_UEContextTransfer message. AMF #1 may send to AMF #2 amessage that includes the requested UE context. This message may be aNamf_ Communication_ UEContextTransfer message. After the UE context isreceived, the AMF #2 may coordinate authentication of the UE. Afterauthentication is complete, AMF #2 may send to AMF #1 a messageindicating that the UE context transfer is complete. This message may bea Namf_ Communication_UEContextTransfer Response message.

Authentication may require participation of the UE, an AUSF, a UDMand/or a UDR (not shown). For example, the AMF may request that the AUSFauthenticate the UE. For example, the AUSF may execute authentication ofthe UE. For example, the AUSF may get authentication data from UDM. Forexample, the AUSF may send a subscription permanent identifier (SUPI) tothe AMF based on the authentication being successful. For example, theAUSF may provide an intermediate key to the AMF. The intermediate keymay be used to derive an access-specific security key for the UE,enabling the AMF to perform security context management (SCM). The AUSFmay obtain subscription data from the UDM. The subscription data may bebased on information obtained from the UDM (and/or the UDR). Thesubscription data may include subscription identifiers, securitycredentials, access and mobility related subscription data and/orsession related data.

At 1030, the new AMF, AMF #2, registers and/or subscribes with the UDM.AMF #2 may perform registration using a UE context management service ofthe UDM (Nudm_UECM). AMF #2 may obtain subscription information of theUE using a subscriber data management service of the UDM (Nudm_ SDM).AMF #2 may further request that the UDM notify AMF #2 if thesubscription information of the UE changes. As the new AMF registers andsubscribes, the old AMF, AMF #1, may deregister and unsubscribe. Afterderegistration, AMF #1 is free of responsibility for mobility managementof the UE.

At 1040, AMF #2 retrieves access and mobility (AM) policies from thePCF. As an example, the AMF #2 may provide subscription data of the UEto the PCF. The PCF may determine access and mobility policies for theUE based on the subscription data, network operator data, currentnetwork conditions, and/or other suitable information. For example, theowner of a first UE may purchase a higher level of service than theowner of a second UE. The PCF may provide the rules associated with thedifferent levels of service. Based on the subscription data of therespective UEs, the network may apply different policies whichfacilitate different levels of service.

For example, access and mobility policies may relate to service arearestrictions, RAT/frequency selection priority (RFSP, where RAT standsfor radio access technology), authorization and prioritization of accesstype (e.g., LTE versus NR), and/or selection of non-3GPP access (e.g.,Access Network Discovery and Selection Policy (ANDSP)). The service arearestrictions may comprise a list of tracking areas where the UE isallowed to be served (or forbidden from being served). The access andmobility policies may include a UE route selection policy (URSP)) thatinfluences routing to an established PDU session or a new PDU session.As noted above, different policies may be obtained and/or enforced basedon subscription data of the UE, location of the UE (i.e., location ofthe AN and/or AMF), or other suitable factors.

At 1050, AMF #2 may update a context of a PDU session. For example, ifthe UE has an existing PDU session, the AMF #2 may coordinate with anSMF to activate a user plane connection associated with the existing PDUsession. The SMF may update and/or release a session management contextof the PDU session (Nsmf_ PDUSession_ UpdateSMContext, Nsmf_ PDUSession_ReleaseSMContext).

At 1060, AMF #2 sends a registration accept message to the AN, whichforwards the registration accept message to the UE. The registrationaccept message may include a new UE identifier and/or a new configuredslice identifier. The UE may transmit a registration complete message tothe AN, which forwards the registration complete message to the AMF #2.The registration complete message may acknowledge receipt of the new UEidentifier and/or new configured slice identifier.

At 1070, AMF #2 may obtain UE policy control information from the PCF.The PCF may provide an access network discovery and selection policy(ANDSP) to facilitate non-3GPP access. The PCF may provide a UE routeselection policy (URSP) to facilitate mapping of particular data trafficto particular PDU session connectivity parameters. As an example, theURSP may indicate that data traffic associated with a particularapplication should be mapped to a particular SSC mode, network slice,PDU session type, or preferred access type (3GPP or non-3GPP).

FIG. 11 illustrates an example of a service request procedure for awireless device (e.g., a UE). The service request procedure depicted inFIG. 11 is a network-triggered service request procedure for a UE in aCM-IDLE state. However, other service request procedures (e.g., aUE-triggered service request procedure) may also be understood byreference to FIG. 11 , as will be discussed in greater detail below.

At 1110, a UPF receives data. The data may be downlink data fortransmission to a UE. The data may be associated with an existing PDUsession between the UE and a DN. The data may be received, for example,from a DN and/or another UPF. The UPF may buffer the received data. Inresponse to the receiving of the data, the UPF may notify an SMF of thereceived data. The identity of the SMF to be notified may be determinedbased on the received data. The notification may be, for example, an N4session report. The notification may indicate that the UPF has receiveddata associated with the UE and/or a particular PDU session associatedwith the UE. In response to receiving the notification, the SMF may sendPDU session information to an AMF. The PDU session information may besent in an N1N2 message transfer for forwarding to an AN. The PDUsession information may include, for example, UPF tunnel endpointinformation and/or QoS information.

At 1120, the AMF determines that the UE is in a CM-IDLE state. Thedetermining at 1120 may be in response to the receiving of the PDUsession information. Based on the determination that the UE is CM-IDLE,the service request procedure may proceed to 1130 and 1140, as depictedin FIG. 11 . However, if the UE is not CM-IDLE (e.g., the UE isCM-CONNECTED), then 1130 and 1140 may be skipped, and the servicerequest procedure may proceed directly to 1150.

At 1130, the AMF pages the UE. The paging at 1130 may be performed basedon the UE being CM-IDLE. To perform the paging, the AMF may send a pageto the AN. The page may be referred to as a paging or a paging message.The page may be an N2 request message. The AN may be one of a pluralityof ANs in a RAN notification area of the UE. The AN may send a page tothe UE. The UE may be in a coverage area of the AN and may receive thepage.

At 1140, the UE may request service. The UE may transmit a servicerequest to the AMF via the AN. As depicted in FIG. 11 , the UE mayrequest service at 1140 in response to receiving the paging at 1130.However, as noted above, this is for the specific case of anetwork-triggered service request procedure. In some scenarios (forexample, if uplink data becomes available at the UE), then the UE maycommence a UE-triggered service request procedure. The UE-triggeredservice request procedure may commence starting at 1140.

At 1150, the network may authenticate the UE. Authentication may requireparticipation of the UE, an AUSF, and/or a UDM, for example, similar toauthentication described elsewhere in the present disclosure. In somecases (for example, if the UE has recently been authenticated), theauthentication at 1150 may be skipped.

At 1160, the AMF and SMF may perform a PDU session update. As part ofthe PDU session update, the SMF may provide the AMF with one or more UPFtunnel endpoint identifiers. In some cases (not shown in FIG. 11 ), itmay be necessary for the SMF to coordinate with one or more other SMFsand/or one or more other UPFs to set up a user plane.

At 1170, the AMF may send PDU session information to the AN. The PDUsession information may be included in an N2 request message. Based onthe PDU session information, the AN may configure a user plane resourcefor the UE. To configure the user plane resource, the AN may, forexample, perform an RRC reconfiguration of the UE. The AN mayacknowledge to the AMF that the PDU session information has beenreceived. The AN may notify the AMF that the user plane resource hasbeen configured, and/or provide information relating to the user planeresource configuration.

In the case of a UE-triggered service request procedure, the UE mayreceive, at 1170, a NAS service accept message from the AMF via the AN.After the user plane resource is configured, the UE may transmit uplinkdata (for example, the uplink data that caused the UE to trigger theservice request procedure).

At 1180, the AMF may update a session management (SM) context of the PDUsession. For example, the AMF may notify the SMF (and/or one or moreother associated SMFs) that the user plane resource has been configured,and/or provide information relating to the user plane resourceconfiguration. The AMF may provide the SMF (and/or one or more otherassociated SMFs) with one or more AN tunnel endpoint identifiers of theAN. After the SM context update is complete, the SMF may send an updateSM context response message to the AMF.

Based on the update of the session management context, the SMF mayupdate a PCF for purposes of policy control. For example, if a locationof the UE has changed, the SMF may notify the PCF of the UE's a newlocation.

Based on the update of the session management context, the SMF and UPFmay perform a session modification. The session modification may beperformed using N4 session modification messages. After the sessionmodification is complete, the UPF may transmit downlink data (forexample, the downlink data that caused the UPF to trigger thenetwork-triggered service request procedure) to the UE. The transmittingof the downlink data may be based on the one or more AN tunnel endpointidentifiers of the AN.

FIG. 12 illustrates an example of a protocol data unit (PDU) sessionestablishment procedure for a wireless device (e.g., a UE). The UE maydetermine to transmit the PDU session establishment request to create anew PDU session, to hand over an existing PDU session to a 3GPP network,or for any other suitable reason.

At 1210, the UE initiates PDU session establishment. The UE may transmita PDU session establishment request to an AMF via an AN. The PDU sessionestablishment request may be a NAS message. The PDU sessionestablishment request may indicate: a PDU session ID; a requested PDUsession type (new or existing); a requested DN (DNN); a requestednetwork slice (S-NSSAI); a requested SSC mode; and/or any other suitableinformation. The PDU session ID may be generated by the UE. The PDUsession type may be, for example, an Internet Protocol (IP)-based type(e.g., IPv4, IPv6, or dual stack IPv4/IPv6), an Ethernet type, or anunstructured type.

The AMF may select an SMF based on the PDU session establishmentrequest. In some scenarios, the requested PDU session may already beassociated with a particular SMF. For example, the AMF may store a UEcontext of the UE, and the UE context may indicate that the PDU sessionID of the requested PDU session is already associated with theparticular SMF. In some scenarios, the AMF may select the SMF based on adetermination that the SMF is prepared to handle the requested PDUsession. For example, the requested PDU session may be associated with aparticular DNN and/or S-NSSAI, and the SMF may be selected based on adetermination that the SMF can manage a PDU session associated with theparticular DNN and/or S-NSSAI.

At 1220, the network manages a context of the PDU session. Afterselecting the SMF at 1210, the AMF sends a PDU session context requestto the SMF. The PDU session context request may include the PDU sessionestablishment request received from the UE at 1210. The PDU sessioncontext request may be a Nsmf_ PDUSession_CreateSMContext Request and/ora Nsmf_ PDUSession_ UpdateSMContext Request. The PDU session contextrequest may indicate identifiers of the UE; the requested DN; and/or therequested network slice. Based on the PDU session context request, theSMF may retrieve subscription data from a UDM. The subscription data maybe session management subscription data of the UE. The SMF may subscribefor updates to the subscription data, so that the PCF will send newinformation if the subscription data of the UE changes. After thesubscription data of the UE is obtained, the SMF may transmit a PDUsession context response to the AMG. The PDU session context responsemay be a Nsmf_ PDUSession_ CreateSMContext Response and/or a Nsmf_PDUSession_ UpdateSMContext Response. The PDU session context responsemay include a session management context ID.

At 1230, secondary authorization/authentication may be performed, ifnecessary. The secondary authorization/authentication may involve theUE, the AMF, the SMF, and the DN. The SMF may access the DN via a DataNetwork Authentication, Authorization and Accounting (DN AAA) server.

At 1240, the network sets up a data path for uplink data associated withthe PDU session. The SMF may select a PCF and establish a sessionmanagement policy association. Based on the association, the PCF mayprovide an initial set of policy control and charging rules (PCC rules)for the PDU session. When targeting a particular PDU session, the PCFmay indicate, to the SMF, a method for allocating an IP address to thePDU Session, a default charging method for the PDU session, an addressof the corresponding charging entity, triggers for requesting newpolicies, etc. The PCF may also target a service data flow (SDF)comprising one or more PDU sessions. When targeting an SDF, the PCF mayindicate, to the SMF, policies for applying QoS requirements, monitoringtraffic (e.g., for charging purposes), and/or steering traffic (e.g., byusing one or more particular N6 interfaces).

The SMF may determine and/or allocate an IP address for the PDU session.The SMF may select one or more UPFs (a single UPF in the example of FIG.12 ) to handle the PDU session. The SMF may send an N4 session messageto the selected UPF. The N4 session message may be an N4 SessionEstablishment Request and/or an N4 Session Modification Request. The N4session message may include packet detection, enforcement, and reportingrules associated with the PDU session. In response, the UPF mayacknowledge by sending an N4 session establishment response and/or an N4session modification response.

The SMF may send PDU session management information to the AMF. The PDUsession management information may be a Namf_ Communication_N1N2MessageTransfer message. The PDU session management information mayinclude the PDU session ID. The PDU session management information maybe a NAS message. The PDU session management information may include N1session management information and/or N2 session management information.The N1 session management information may include a PDU sessionestablishment accept message. The PDU session establishment acceptmessage may include tunneling endpoint information of the UPF andquality of service (QoS) information associated with the PDU session.

The AMF may send an N2 request to the AN. The N2 request may include thePDU session establishment accept message. Based on the N2 request, theAN may determine AN resources for the UE. The AN resources may be usedby the UE to establish the PDU session, via the AN, with the DN. The ANmay determine resources to be used for the PDU session and indicate thedetermined resources to the UE. The AN may send the PDU sessionestablishment accept message to the UE. For example, the AN may performan RRC reconfiguration of the UE. After the AN resources are set up, theAN may send an N2 request acknowledge to the AMF. The N2 requestacknowledge may include N2 session management information, for example,the PDU session ID and tunneling endpoint information of the AN.

After the data path for uplink data is set up at 1240, the UE mayoptionally send uplink data associated with the PDU session. As shown inFIG. 12 , the uplink data may be sent to a DN associated with the PDUsession via the AN and the UPF.

At 1250, the network may update the PDU session context. The AMF maytransmit a PDU session context update request to the SMF. The PDUsession context update request may be a Nsmf_ PDUSession_UpdateSMContext Request. The PDU session context update request mayinclude the N2 session management information received from the AN. TheSMF may acknowledge the PDU session context update. The acknowledgementmay be a Nsmf_ PDUSession_ UpdateSMContext Response. The acknowledgementmay include a subscription requesting that the SMF be notified of any UEmobility event. Based on the PDU session context update request, the SMFmay send an N4 session message to the UPF. The N4 session message may bean N4 Session Modification Request. The N4 session message may includetunneling endpoint information of the AN. The N4 session message mayinclude forwarding rules associated with the PDU session. In response,the UPF may acknowledge by sending an N4 session modification response.

After the UPF receives the tunneling endpoint information of the AN, theUPF may relay downlink data associated with the PDU session. As shown inFIG. 12 , the downlink data may be received from a DN associated withthe PDU session via the AN and the UPF.

FIG. 13 illustrates examples of components of the elements in acommunications network. FIG. 13 includes a wireless device 1310, a basestation 1320, and a physical deployment of one or more network functions1330 (henceforth “deployment 1330”). Any wireless device described inthe present disclosure may have similar components and may beimplemented in a similar manner as the wireless device 1310. Any otherbase station described in the present disclosure (or any portionthereof, depending on the architecture of the base station) may havesimilar components and may be implemented in a similar manner as thebase station 1320. Any physical core network deployment in the presentdisclosure (or any portion thereof, depending on the architecture of thebase station) may have similar components and may be implemented in asimilar manner as the deployment 1330.

The wireless device 1310 may communicate with base station 1320 over anair interface 1370. The communication direction from wireless device1310 to base station 1320 over air interface 1370 is known as uplink,and the communication direction from base station 1320 to wirelessdevice 1310 over air interface 1370 is known as downlink. Downlinktransmissions may be separated from uplink transmissions using FDD, TDD,and/or some combination of duplexing techniques. FIG. 13 shows a singlewireless device 1310 and a single base station 1320, but it will beunderstood that wireless device 1310 may communicate with any number ofbase stations or other access network components over air interface1370, and that base station 1320 may communicate with any number ofwireless devices over air interface 1370.

The wireless device 1310 may comprise a processing system 1311 and amemory 1312. The memory 1312 may comprise one or more computer-readablemedia, for example, one or more non-transitory computer readable media.The memory 1312 may include instructions 1313. The processing system1311 may process and/or execute instructions 1313. Processing and/orexecution of instructions 1313 may cause wireless device 1310 and/orprocessing system 1311 to perform one or more functions or activities.The memory 1312 may include data (not shown). One of the functions oractivities performed by processing system 1311 may be to store data inmemory 1312 and/or retrieve previously-stored data from memory 1312. Inan example, downlink data received from base station 1320 may be storedin memory 1312, and uplink data for transmission to base station 1320may be retrieved from memory 1312. As illustrated in FIG. 13 , thewireless device 1310 may communicate with base station 1320 using atransmission processing system 1314 and/or a reception processing system1315. Alternatively, transmission processing system 1314 and receptionprocessing system 1315 may be implemented as a single processing system,or both may be omitted and all processing in the wireless device 1310may be performed by the processing system 1311. Although not shown inFIG. 13 , transmission processing system 1314 and/or receptionprocessing system 1315 may be coupled to a dedicated memory that isanalogous to but separate from memory 1312, and comprises instructionsthat may be processed and/or executed to carry out one or more of theirrespective functionalities. The wireless device 1310 may comprise one ormore antennas 1316 to access air interface 1370.

The wireless device 1310 may comprise one or more other elements 1319.The one or more other elements 1319 may comprise software and/orhardware that provide features and/or functionalities, for example, aspeaker, a microphone, a keypad, a display, a touchpad, a satellitetransceiver, a universal serial bus (USB) port, a hands-free headset, afrequency modulated (FM) radio unit, a media player, an Internetbrowser, an electronic control unit (e.g., for a motor vehicle), and/orone or more sensors (e.g., an accelerometer, a gyroscope, a temperaturesensor, a radar sensor, a lidar sensor, an ultrasonic sensor, a lightsensor, a camera, a global positioning sensor (GPS) and/or the like).The wireless device 1310 may receive user input data from and/or provideuser output data to the one or more one or more other elements 1319. Theone or more other elements 1319 may comprise a power source. Thewireless device 1310 may receive power from the power source and may beconfigured to distribute the power to the other components in wirelessdevice 1310. The power source may comprise one or more sources of power,for example, a battery, a solar cell, a fuel cell, or any combinationthereof.

The wireless device 1310 may transmit uplink data to and/or receivedownlink data from base station 1320 via air interface 1370. To performthe transmission and/or reception, one or more of the processing system1311, transmission processing system 1314, and/or reception system 1315may implement open systems interconnection (OSI) functionality. As anexample, transmission processing system 1314 and/or reception system1315 may perform layer 1 OSI functionality, and processing system 1311may perform higher layer functionality. The wireless device 1310 maytransmit and/or receive data over air interface 1370 using one or moreantennas 1316. For scenarios where the one or more antennas 1316 includemultiple antennas, the multiple antennas may be used to perform one ormore multi-antenna techniques, such as spatial multiplexing (e.g.,single-user multiple-input multiple output (MIMO) or multi-user MIMO),transmit/receive diversity, and/or beamforming.

The base station 1320 may comprise a processing system 1321 and a memory1322. The memory 1322 may comprise one or more computer-readable media,for example, one or more non-transitory computer readable media. Thememory 1322 may include instructions 1323. The processing system 1321may process and/or execute instructions 1323. Processing and/orexecution of instructions 1323 may cause base station 1320 and/orprocessing system 1321 to perform one or more functions or activities.The memory 1322 may include data (not shown). One of the functions oractivities performed by processing system 1321 may be to store data inmemory 1322 and/or retrieve previously-stored data from memory 1322. Thebase station 1320 may communicate with wireless device 1310 using atransmission processing system 1324 and a reception processing system1325. Although not shown in FIG. 13 , transmission processing system1324 and/or reception processing system 1325 may be coupled to adedicated memory that is analogous to but separate from memory 1322, andcomprises instructions that may be processed and/or executed to carryout one or more of their respective functionalities. The wireless device1320 may comprise one or more antennas 1326 to access air interface1370.

The base station 1320 may transmit downlink data to and/or receiveuplink data from wireless device 1310 via air interface 1370. To performthe transmission and/or reception, one or more of the processing system1321, transmission processing system 1324, and/or reception system 1325may implement OSI functionality. As an example, transmission processingsystem 1324 and/or reception system 1325 may perform layer 1 OSIfunctionality, and processing system 1321 may perform higher layerfunctionality. The base station 1320 may transmit and/or receive dataover air interface 1370 using one or more antennas 1326. For scenarioswhere the one or more antennas 1326 include multiple antennas, themultiple antennas may be used to perform one or more multi-antennatechniques, such as spatial multiplexing (e.g., single-usermultiple-input multiple output (MIMO) or multi-user MIMO),transmit/receive diversity, and/or beamforming.

The base station 1320 may comprise an interface system 1327. Theinterface system 1327 may communicate with one or more base stationsand/or one or more elements of the core network via an interface 1380.The interface 1380 may be wired and/or wireless and interface system1327 may include one or more components suitable for communicating viainterface 1380. In FIG. 13 , interface 1380 connects base station 1320to a single deployment 1330, but it will be understood that wirelessdevice 1310 may communicate with any number of base stations and/or CNdeployments over interface 1380, and that deployment 1330 maycommunicate with any number of base stations and/or other CN deploymentsover interface 1380. The base station 1320 may comprise one or moreother elements 1329 analogous to one or more of the one or more otherelements 1319.

The deployment 1330 may comprise any number of portions of any number ofinstances of one or more network functions (NFs). The deployment 1330may comprise a processing system 1331 and a memory 1332. The memory 1332may comprise one or more computer-readable media, for example, one ormore non-transitory computer readable media. The memory 1332 may includeinstructions 1333. The processing system 1331 may process and/or executeinstructions 1333. Processing and/or execution of instructions 1333 maycause the deployment 1330 and/or processing system 1331 to perform oneor more functions or activities. The memory 1332 may include data (notshown). One of the functions or activities performed by processingsystem 1331 may be to store data in memory 1332 and/or retrievepreviously-stored data from memory 1332. The deployment 1330 may accessthe interface 1380 using an interface system 1337. The deployment 1330may comprise one or more other elements 1339 analogous to one or more ofthe one or more other elements 1319.

One or more of the systems 1311, 1314, 1315, 1321, 1324, 1325, and/or1331 may comprise one or more controllers and/or one or more processors.The one or more controllers and/or one or more processors may comprise,for example, a general-purpose processor, a digital signal processor(DSP), a microcontroller, an application specific integrated circuit(ASIC), a field programmable gate array (FPGA) and/or other programmablelogic device, discrete gate and/or transistor logic, discrete hardwarecomponents, an on-board unit, or any combination thereof. One or more ofthe systems 1311, 1314, 1315, 1321, 1324, 1325, and/or 1331 may performsignal coding/processing, data processing, power control, input/outputprocessing, and/or any other functionality that may enable wirelessdevice 1310, base station 1320, and/or deployment 1330 to operate in amobile communications system.

Many of the elements described in the disclosed embodiments may beimplemented as modules. A module is defined here as an element thatperforms a defined function and has a defined interface to otherelements. The modules described in this disclosure may be implemented inhardware, software in combination with hardware, firmware, wetware (e.g.hardware with a biological element) or a combination thereof, which maybe behaviorally equivalent. For example, modules may be implemented as asoftware routine written in a computer language configured to beexecuted by a hardware machine (such as C, C++, Fortran, Java, Basic,Matlab or the like) or a modeling/simulation program such as Simulink,Stateflow, GNU Octave, or Lab VIEWMathScript. It may be possible toimplement modules using physical hardware that incorporates discrete orprogrammable analog, digital and/or quantum hardware. Examples ofprogrammable hardware comprise computers, microcontrollers,microprocessors, DSPs, ASICs, FPGAs, and complex programmable logicdevices (CPLDs). Computers, microcontrollers and microprocessors may beprogrammed using languages such as assembly, C, C++ or the like. FPGAs,ASICs and CPLDs are often programmed using hardware descriptionlanguages (HDL) such as VHSIC hardware description language (VHDL) orVerilog that configure connections between internal hardware moduleswith lesser functionality on a programmable device. The mentionedtechnologies are often used in combination to achieve the result of afunctional module.

The wireless device 1310, base station 1320, and/or deployment 1330 mayimplement timers and/or counters. A timer/counter may start at aninitial value. As used herein, starting may comprise restarting. Oncestarted, the timer/counter may run. Running of the timer/counter may beassociated with an occurrence. When the occurrence occurs, the value ofthe timer/counter may change (for example, increment or decrement). Theoccurrence may be, for example, an exogenous event (for example, areception of a signal, a measurement of a condition, etc.), anendogenous event (for example, a transmission of a signal, acalculation, a comparison, a performance of an action or a decision toso perform, etc.), or any combination thereof. In the case of a timer,the occurrence may be the passage of a particular amount of time.However, it will be understood that a timer may be described and/orimplemented as a counter that counts the passage of a particular unit oftime. A timer/counter may run in a direction of a final value until itreaches the final value. The reaching of the final value may be referredto as expiration of the timer/counter. The final value may be referredto as a threshold. A timer/counter may be paused, wherein the presentvalue of the timer/counter is held, maintained, and/or carried over,even upon the occurrence of one or more occurrences that would otherwisecause the value of the timer/counter to change. The timer/counter may beun-paused or continued, wherein the value that was held, maintained,and/or carried over begins changing again when the one or moreoccurrence occur. A timer/counter may be set and/or reset. As usedherein, setting may comprise resetting. When the timer/counter setsand/or resets, the value of the timer/counter may be set to the initialvalue. A timer/counter may be started and/or restarted. As used herein,starting may comprise restarting. In some embodiments, when thetimer/counter restarts, the value of the timer/counter may be set to theinitial value and the timer/counter may begin to run.

FIGS. 14A, 14B, 14C, and 14D illustrate various example arrangements ofphysical core network deployments, each having one or more networkfunctions or portions thereof. The core network deployments comprise adeployment 1410, a deployment 1420, a deployment 1430, a deployment1440, and/or a deployment 1450. Each deployment may be analogous to, forexample, the deployment 1330 depicted in FIG. 13 . In particular, eachdeployment may comprise a processing system for performing one or morefunctions or activities, memory for storing data and/or instructions,and an interface system for communicating with other network elements(for example, other core network deployments). Each deployment maycomprise one or more network functions (NFs). The term NF may refer to aparticular set of functionalities and/or one or more physical elementsconfigured to perform those functionalities (e.g., a processing systemand memory comprising instructions that, when executed by the processingsystem, cause the processing system to perform the functionalities). Forexample, in the present disclosure, when a network function is describedas performing X, Y, and Z, it will be understood that this refers to theone or more physical elements configured to perform X, Y, and Z, nomatter how or where the one or more physical elements are deployed. Theterm NF may refer to a network node, network element, and/or networkdevice.

As will be discussed in greater detail below, there are many differenttypes of NF and each type of NF may be associated with a different setof functionalities. A plurality of different NFs may be flexiblydeployed at different locations (for example, in different physical corenetwork deployments) or in a same location (for example, co-located in asame deployment). A single NF may be flexibly deployed at differentlocations (implemented using different physical core networkdeployments) or in a same location. Moreover, physical core networkdeployments may also implement one or more base stations, applicationfunctions (AFs), data networks (DNs), or any portions thereof. NFs maybe implemented in many ways, including as network elements on dedicatedor shared hardware, as software instances running on dedicated or sharedhardware, or as virtualized functions instantiated on a platform (e.g.,a cloud-based platform).

FIG. 14A illustrates an example arrangement of core network deploymentsin which each deployment comprises one network function. A deployment1410 comprises an NF 1411, a deployment 1420 comprises an NF 1421, and adeployment 1430 comprises an NF 1431. The deployments 1410, 1420, 1430communicate via an interface 1490. The deployments 1410, 1420, 1430 mayhave different physical locations with different signal propagationdelays relative to other network elements. The diversity of physicallocations of deployments 1410, 1420, 1430 may enable provision ofservices to a wide area with improved speed, coverage, security, and/orefficiency.

FIG. 14B illustrates an example arrangement wherein a single deploymentcomprises more than one NF. Unlike FIG. 14A, where each NF is deployedin a separate deployment, FIG. 14B illustrates multiple NFs indeployments 1410, 1420. In an example, deployments 1410, 1420 mayimplement a software-defined network (SDN) and/or a network functionvirtualization (NFV).

For example, deployment 1410 comprises an additional network function,NF 1411A. The NFs 1411, 1411A may consist of multiple instances of thesame NF type, co-located at a same physical location within the samedeployment 1410. The NFs 1411, 1411A may be implemented independentlyfrom one another (e.g., isolated and/or independently controlled). Forexample, the NFs 1411, 1411A may be associated with different networkslices. A processing system and memory associated with the deployment1410 may perform all of the functionalities associated with the NF 1411in addition to all of the functionalities associated with the NF 1411A.In an example, NFs 1411, 1411A may be associated with different PLMNs,but deployment 1410, which implements NFs 1411, 1411A, may be ownedand/or operated by a single entity.

Elsewhere in FIG. 14B, deployment 1420 comprises NF 1421 and anadditional network function, NF 1422. The NFs 1421, 1422 may bedifferent NF types. Similar to NFs 1411, 1411A, the NFs 1421, 1422 maybe co-located within the same deployment 1420, but separatelyimplemented. As an example, a first PLMN may own and/or operatedeployment 1420 having NFs 1421, 1422. As another example, the firstPLMN may implement NF 1421 and a second PLMN may obtain from the firstPLMN (e.g., rent, lease, procure, etc.) at least a portion of thecapabilities of deployment 1420 (e.g., processing power, data storage,etc.) in order to implement NF 1422. As yet another example, thedeployment may be owned and/or operated by one or more third parties,and the first PLMN and/or second PLMN may procure respective portions ofthe capabilities of the deployment 1420. When multiple NFs are providedat a single deployment, networks may operate with greater speed,coverage, security, and/or efficiency.

FIG. 14C illustrates an example arrangement of core network deploymentsin which a single instance of an NF is implemented using a plurality ofdifferent deployments. In particular, a single instance of NF 1422 isimplemented at deployments 1420, 1440. As an example, the functionalityprovided by NF 1422 may be implemented as a bundle or sequence ofsubservices. Each subservice may be implemented independently, forexample, at a different deployment. Each subservices may be implementedin a different physical location. By distributing implementation ofsubservices of a single NF across different physical locations, themobile communications network may operate with greater speed, coverage,security, and/or efficiency.

FIG. 14D illustrates an example arrangement of core network deploymentsin which one or more network functions are implemented using a dataprocessing service. In FIG. 14D, NFs 1411, 1411A, 1421, 1422 areincluded in a deployment 1450 that is implemented as a data processingservice. The deployment 1450 may comprise, for example, a cloud networkand/or data center. The deployment 1450 may be owned and/or operated bya PLMN or by a non-PLMN third party. The NFs 1411, 1411A, 1421, 1422that are implemented using the deployment 1450 may belong to the samePLMN or to different PLMNs. The PLMN(s) may obtain (e.g., rent, lease,procure, etc.) at least a portion of the capabilities of the deployment1450 (e.g., processing power, data storage, etc.). By providing one ormore NFs using a data processing service, the mobile communicationsnetwork may operate with greater speed, coverage, security, and/orefficiency.

As shown in the figures, different network elements (e.g., NFs) may belocated in different physical deployments, or co-located in a singlephysical deployment. It will be understood that in the presentdisclosure, the sending and receiving of messages among differentnetwork elements is not limited to inter-deployment transmission orintra-deployment transmission, unless explicitly indicated.

In an example, a deployment may be a ‘black box’ that is preconfiguredwith one or more NFs and preconfigured to communicate, in a prescribedmanner, with other ‘black box’ deployments (e.g., via the interface1490). Additionally or alternatively, a deployment may be configured tooperate in accordance with open-source instructions (e.g., software)designed to implement NFs and communicate with other deployments in atransparent manner. The deployment may operate in accordance with openRAN (O-RAN) standards.

Each CN deployment may comprise one or more network functions. Dependingon the context in which the term is used, a network function (NF) mayrefer to a particular set of functionalities and/or one or more physicalelements configured to perform those functionalities (e.g., a processingsystem and memory comprising instructions that, when executed by theprocessing system, cause the processing system to perform thefunctionalities). There are many different types of NF and each type ofNF may be associated with a different set of functionalities. DifferentNFs may be flexibly deployed at different locations (for example, indifferent physical core network deployments) or in a same location (forexample, co-located in the same physical core network deployment).Moreover, physical CN deployment are not limited to implementation ofNFs. For example, a particular physical CN deployment may furtherinclude a base station or portions therefor and/or a data network orportions thereof. Accordingly, one or more NFs implemented on aparticular physical core network deployment may be co-located with oneor more non-core elements, including elements of an access network ordata network.

FIG. 15 illustrates a service-based architecture for a 5G networkregarding a control plane (CP) and a user plane (UP) interaction. Thisillustration may depict logical connections between nodes and functions,and its illustrated connections may not be interpreted as directphysical connections. A wireless device may form a radio access networkconnection with a bases station, which is connected to a User Plane (UP)Function (UPF) over a network interface providing a defined interfacesuch as an N3 interface. The UPF may provide a logical connection to adata network (DN) over a network interface such as an N6 interface. Theradio access network connection between the wireless device and the basestation may be referred to as a data radio bearer (DRB).

The DN may be a data network used to provide an operator service, thirdparty service such as the Internet, IP multimedia subsystem (IMS),augmented reality (AR), virtual reality (VR). In some embodiments DN mayrepresent an edge computing network or resource, such as a mobile edgecomputing (MEC) network.

The wireless device also connects to the AMF through a logical N1connection. The AMF may be responsible for authentication and/orauthorization of access requests, as well as mobility managementfunctions. The AMF may perform other roles and functions. In aservice-based view, AMF may communicate with other core network controlplane functions through a service-based interface denoted as Namf.

The SMF is a network function that may be responsible for the allocationand management of IP addresses that are assigned to a wireless device aswell as the selection of a UPF for traffic associated with a particularsession of the wireless device. There will be typically multiple SMFs inthe network, each of which may be associated with a respective group ofwireless devices, base stations or UPFs. The SMF may communicate withother core network functions, in a service based view, through a servicebased interface denoted as Nsmf. The SMF may also connect to a UPFthrough a logical interface such as network interface N4.

The authentication server function (AUSF) may provide authenticationservices to other network functions over a service based Nausfinterface. A network exposure function (NEF) can be deployed in thenetwork to allow servers, functions and other entities such as thoseoutside a trusted domain (operator network) to have exposure to servicesand capabilities within the network. In one such example, the NEF mayact like a proxy between an external application server (AS) outside theillustrated network and network functions such as the PCF, the SMF, theUDM and the AMF. The external AS may provide information that may be ofuse in the setup of the parameters associated with a data session. TheNEF may communicate with other network functions through a service basedNnef network interface. The NEF may have an interface to non-3GPPfunctions.

The Network Repository Function (NRF) may provide network servicediscovery functionality. The NRF may be specific to the Public LandMobility Network (PLMN) or network operator, with which it isassociated. The service discovery functionality can allow networkfunctions and wireless devices connected to the network to determinewhere and how to access existing network functions.

The PCF may communicate with other network functions over a servicebased Npcf interface, and may be used to provide policy and rules toother network functions, including those within the control plane.Enforcement and application of the policies and rules may not beresponsibility of the PCF. The responsibility of the functions to whichthe PCF transmits the policy may be responsibility of the AMF or theSMF. In one such example, the PCF may transmit policy associated withsession management to the SMF. This may be used to allow for a unifiedpolicy framework with which network behavior can be governed.

The UDM may present a service based Nudm interface to communicate withother network functions. The UDM may provide data storage facilities toother network functions. Unified data storage may allow for aconsolidated view of network information that may be used to ensure thatthe most relevant information can be made available to different networkfunctions from a single resource. This may allow implementation of othernetwork functions easier, as they may not need to determine where aparticular type of data is stored in the network. The UDM may employ aninterface, such as Nudr to connect to the UDR. The PCF may be associatedwith the UDM.

The PCF may have a direct interface to the UDR or may use Nudr interfaceto connection with UDR. The UDM may receive requests to retrieve contentstored in the UDR, or requests to store content in the UDR. The UDM maybe responsible for functionality such as the processing of credentials,location management and subscription management. The UDR may alsosupport authentication credential processing, user identificationhandling, access authorization, registration/mobility management,subscription management, and short message service (SMS) management. TheUDR may be responsible for storing data provided by the UDM. The storeddata is associated with policy profile information (which may beprovided by PCF) that governs the access rights to the stored data. Insome embodiments, the UDR may store policy data, as well as usersubscription data which may include any or all of subscriptionidentifiers, security credentials, access and mobility relatedsubscription data and session related data.

The Application Function (AF) may represent the non-data plane (alsoreferred to as the non-user plane) functionality of an applicationdeployed within a network operator domain and within a 3GPP compliantnetwork. The AF may in internal application server (AS). The AF mayinteract with other core network functions through a service based Nafinterface, and may access network capability exposure information, aswell as provide application information for use in decisions such astraffic routing. The AF can also interact with functions such as the PCFto provide application specific input into policy and policy enforcementdecisions. In many situations, the AF may not provide network servicesto other network functions. The AF may be often viewed as a consumer oruser of services provided by other network functions. An application(application server) outside of the trusted domain (operator network),may perform many of the same functions as AF through the use of NEF.

The wireless device may communicate with network functions that are inthe core network control plane (CN-UP), and the core network user plane(CN-CP). The UPF and the data network (DN) is a part of the CN-UP. TheDN may be out of core network domain (cellular network domain). In theillustration (FIG. 15 ), base station locates in CP-UP side. The basestation may provide connectivity both for the CN-CP & CN-UP. AMF, SMF,AUSF, NEF, NRF, PCF, and UDM may be functions that reside within theCN-CP, and are often referred to as control plane functions. If the AFresides in the trusted domain, the AF may communicate with otherfunctions within CN-CP directly via the service based Naf interface. Ifthe AF resides outside of the trusted domain, the AM may communicatewith other functions within CN-CP indirectly via the NEF.

An unmanned and/or uncrewed aerial vehicle (UAV) may be an aircraftwithout a human pilot on board. An unmanned and/or uncrewed aerialsystem (UAS) may be an entire system needed to operate the UAV. Asillustrated in FIG. 16 , the UAS may comprise the UAV, a ground controlsystem (e.g., UAV controller), a camera, a positioning system, one ormore software, and skills needed to operate the UAS. Wireless network(e.g., cellular network, 4G cellular network, 5G cellular network),which may enable the ground control system (e.g., UAV controller, UTM)to communicate with the UAV may be one of the components of the UAS.

In an example, a wireless device may be the UAV. The wireless device maybe an aerial wireless device. The wireless device may fly above theground. As illustrated in FIG. 17 , the wireless device may experiencehigh line-of-sight (LOS) propagation probability. The wireless devicemay receive downlink (e.g., from a base station to the wireless device)interference from a larger number of cells than a typical terrestrialwireless device does. In the downlink direction, there may be higherprobability that the number of neighboring cells causing high level ofdownlink interference at the wireless device than in the case ofterrestrial wireless device. In an example, 16 cells causing high levelof downlink direction interference may be observed by the wirelessdevice at heights of 50 m or above. In an example, antennas of a basestation (e.g., eNB, gNB) may be down tilted to serve terrestrialwireless devices. The wireless device may locate above a height of theantennas of the base station. The wireless devices may be served by sidelobes of the antennas of the base station. The wireless device may see astronger signal from a faraway base stations than the one that isgeographically closest. The wireless devices may be served by a farawaybase station instead of the closest one. Downlink direction pathloss anduplink direction pathloss for the aerial wireless device may differ insome scenarios where reciprocity does not hold (e.g., due to differentside lobe orientations in uplink and downlink, or different channelcharacteristic in a frequency domain division deployment (FDD).

Base stations of the wireless network and wireless devices may employradio access network (RAN) functions for an aerial communication service(e.g., UAS, UAV, unmanned and/or uncrewed aerial service). Base stationsand wireless devices may support radio access network (RAN) functionsfor an aerial communication service (e.g., UAS, UAV). The RAN functionsfor the aerial communication service may be an aerial user equipment(UE) communication. In an example, the aerial communication service maybe an aerial user equipment (UE) communication. The aerial communicationservice may support the UAS. The RAN functions for the aerialcommunication service may comprise a height-based measurement reporting,an interference detection for the aerial UE communication, aninterference mitigation for the aerial UE communication, a flight pathinformation reporting, a location reporting for the aerial UEcommunication, and/or the like.

In an example, the base station may send an RRC message (e.g., RRCconfiguration message, RRC reconfiguration message) to a wirelessdevice. The RRC message may comprise one or more measurement eventsregarding the height-based measurement reporting. The one or moremeasurement event may indicate to the wireless device, a heightthreshold for the height-based measurement reporting. The wirelessdevice may receive the measurement event comprising the heightthreshold. The wireless device may send a height report if an altitudeof the wireless device is above or below the height threshold. Theheight report may comprise height of the wireless device, a location ofthe wireless device, and/or the like.

If received signaling power (e.g., RSRP) of multiple neighboring cellsare above certain levels for a wireless device, the wireless device mayexperience or introduce interference. For interference detection, thebase station may configure radio resource management (RRM) event thattriggers measurement report when individual (per cell) RSRP values for aconfigured number of cells (e.g., 8, 16) fulfill the configured event.The configured event may be for the interference detection. The RRMevent may be A3, A4 or A5. The wireless device may send a measurementreport in response to determine that the RRM event occurs.

In an example, for the interference mitigation, the base station mayconfigure with a wireless device specific alpha parameter for physicaluplink shared channel (PUSCH) power control. The base station may send aradio resource control (RRC) message comprising the alpha parameter forthe PUSCH power control. If a wireless device receives the dedicatedalpha parameter (e.g., alpha-UE) from the base station, the wireless mayapply the dedicated alpha parameter instead of a common alpha parameter.

In an example, a base station may request to a wireless device to reportflight path information by sending a user equipment information requestmessage. The flight path information may comprise a number of waypointsdefined as 3D locations. The user equipment information message mayindicate a maximum number of waypoints and/or whether timestamps arerequired for the waypoints. The wireless device may receive the userequipment information message. If the wireless device is available toreport the flight path, the wireless device may send a user equipmentinformation response message to the base station. The user equipmentresponse message may comprise one or more waypoints and one or moretimestamps associated with the one or more waypoints. The base stationmay use the flight path information for congestion prediction orresource handling to mitigate interference.

In an example, for the location reporting for the aerial UEcommunication, the base station may request to a wireless device toinclude a horizontal and vertical speed of the wireless device forlocation information reporting. The wireless device may send locationinformation reporting to the base station. The location informationreporting may comprise the horizontal speed, the vertical speed, and/orthe like. The location information may further comprise height of thewireless device.

Remote identification (RID) may be a technology to avoid collisionbetween different UAVs or between manned aircrafts and UAVs. To preventscollision accidents, a federal aviation authority (FAA) may integratethe UAVs into a national airspace system (NAS) by introducing the RID.The RID may be an ability of a UAS in flight to provide identificationand tracking information that may be received by other parties and mayplay a role in identifying and grounding unauthorized UAS in restrictedareas. In an example, UAVs above 0.55 lbs. may be mandated to supportRID. There may be two types of RID: standard RID and limited RID. Forstandard RID, a UAV may support a network publishing identification (ID)and a direct broadcast ID. For limited RID, the UAV may support thenetwork publishing ID. For limited RID, the UAV may not support thedirect broadcast ID. The network publishing ID may be based oncommunication via an internet from a RID server provider that interfaceswith the UAV. The direct broadcast ID may be based on directtransmission of the RID by a UAV using its onboard direct transmissiontechnology (e.g., Bluetooth, Wi-Fi module). A UAV that supports thelimited RID (e.g., does not support the direct broadcast ID) may be notallowed to fly above 400 feet. A UAV that supports the limited RID,network connectivity may be required during the flight. A UAS thatsupports the standard RID may be allowed to fly above 400 feet and thereis no restriction for the network connectivity.

In an example, command and control communication may be a user planelink to deliver message with information of command and control for UAVoperation from a UAV controller or a UTM to the UAV. The command andcontrol communication may be C2 communication. The C2 communicationcomprises three types of communication 1) direct C2 communication, 2)network assisted C2 communication, 3) UTM navigated C2 communication.The direct C2 communication may use the direct communication linkbetween a UAV and a UAV controller. The network assisted C2communication may use cellular network (e.g., public land mobilenetwork) for a communication between the UAV and the UAV controller. Forthe UTM navigated C2 communication may use, the UTM may provide apre-scheduled flight plan to the UAV and the UTM may keep track andverify up to date restrictions or flight plan to the UAV.

FIG. 18 shows an example interfaces (e.g., U2U, UAV3, UAV6, UAV8, UAV9)for the unmanned and/or uncrewed aerial system with wireless network(e.g., PLMN1, PLMN2). The interface may be a communication connectivity.In an example, U2U interface may be an interface for the directbroadcast ID. UAV8 interface may be an interface for the direct C2communication between the UAV and the UAV controller. The UAV3 interfacemay be an interface between the UAV and the UAV controller via wirelessnetwork. In an example, the UAV3 may be in intra-PLMN or inter-PLMN. Inan example, for the intra-PLMN, the PLMN1 and PLMN2 may be same PLMN.For the inter-PLMN, the PLMN1 and the PLMN2 may be different PLMN. In anexample, the UAV9 may be interface between the UAV and a networked UAVcontroller and the USS/UTM for UAS management (e.g., authenticationand/or authorization, transporting C2, RID and tracking information ofthe UAV). In an example, the UAV6 may be interface between the PLMN(e.g., 3GPP network) and a USS/UTM for functionality exposure, supportof identification and tracking, and a UAV authentication/authorization.

FIG. 19 illustrates an example registration procedure regarding anauthentication and/or authorization (AA) for a UAS service between awireless device (e.g., UE, UAV), a base station (e.g., NR-RAN, gNB), amobility management function (e.g., AMF), a session management function(e.g., SMF), a subscription server (e.g., UDM), a UAS network function(NF) and a traffic manager (e.g., UTM, USS). The traffic manager may bea server (e.g., an AA server). The status of the wireless device withrespect to the authentication and/or authorization may be referred to asan authentication and/or authorization status (AA status), USS UAVauthentication and/or authorization status (UUAA status), etc. In anexample, the wireless device may access 5G system via a base station(e.g., gNB). The mobility management function may be an access andmobility management function (AMF). The subscription server may be aunified data management (UDM).

In an example, the wireless device may send a registration requestmessage to the AMF via the base station. The registration requestmessage may comprise an identity of the wireless device, a UAS servicecapability, slice information, a civil aviation authority (CAA) UAVidentifier, and/or the like. In an example, the UAS service capabilitymay be whether the wireless device supports the RAN functions for anaerial communication service (e.g., UAS service). In an example, thecapability of the UAS service may be whether the wireless device requirethe UAS service (e.g., acting as a UAV or UAV controller). An aviationdomain or functions of the aviation domain may assign the CAA UAVidentifier to the wireless device. The CAA UAV identifier may be aCAA-level UAV identifier. In an example, the aviation domain may be aUAS traffic management (UTM) or a UAS service supplier (USS). The CAAUAV identifier may be a CAA UAV identifier. The CAA UAV identifier maybe used for the RID and tracking of the wireless device. The identity ofthe wireless device may comprise at least one of a SUCI, 5G-GUTI, aninternational mobile equipment identity (IMEI), an IMEI software version(IMEISV), a shortened version of 5G-GUTI, and/or the like.

In response to receiving the registration request message, the AMF maysend a UE context request message to a UDM (e.g., subscription server).The UE context request message may comprise an identifier of thewireless device, the capability of the UAS, slice information, the CAAUAV identifier, and/or the like. In an example, the identity of thewireless device may be a subscriber permanent identifier (e.g., IMSI,SUPI) of the wireless device.

In an example, the UDM may receive the UE context request message fromthe AMF. In response to receiving the UE context request message, theUDM may send a UE context response message comprising subscriptioninformation of the wireless device to the AMF. The UDM may determine thesubscription information based on an existence of the capability of theUAS service or the CAA UAV identifier and slice information. In anexample, if the capability of the UAS service is present in the UEcontext request message, the UDM may include unmanned and/or uncrewedaerial service subscription information to the subscription information.In an example, if the CAA UAV identifier is present in the UE contextrequest message, the UDM may include unmanned and/or uncrewed aerialservice subscription information to the subscription information. Thesubscription information may be subscription data. In an example, thesubscription information may indicate whether the wireless device isallowed to get the UAS service. In an example, the subscriptioninformation may indicate whether the wireless device is allowed to getthe UAS service or not. The subscription information may furtherindicate whether an authentication and/or authorization is required forthe UAS service.

The AMF may receive the UE context response message comprising thesubscription information. In response to receiving the UE contextresponse message, the AMF may determine whether an authentication and/orauthorization for the UAS service is required. The determination may bebased on the capability provided by the wireless device, the CAA UAVidentifier, subscription information provided by the subscriptionserver, and/or the like. If the capability indicate that the wirelessdevice does not support the UAS service, the AMF may not allow the UASservice and may not perform the authentication and/or authorization forthe service.

In an example, the subscription information may indicate that thewireless device is allowed to get the UAS service. If the UAS service isallowed for the wireless device, the AMF may check whether the wirelessdevice is required the authentication and/or authorization. If theauthentication and/or authorization is required for the service, the AMFmay indicate to the wireless device that the authentication and/orauthorization for the UAS service is pending. During the authenticationand/or authorization for the UAS service of the wireless device ispending, the AMF may withhold the RAN function activation associatedwith the service with the base station and the wireless device.

If the authentication and/or authorization for the UAS service isrequired based on the subscription information, the AMF may perform theauthentication and/or authorization procedure for the UAS service bysending an authentication and/or authorization (AA) request message toan authentication and/or authorization (AA) server. The AMF may send theAA request message to the AA server via an UAS network function (NF).The AA server may be the UTM or the USS. The AMF may send the AA requestmessage to the AA server via a NEF or new network device (e.g., UASnetwork function) for the UAS service. The AA request message maycomprise the CAA UAV identity, a GPSI, and/or the like. The AA servermay use the CAA UAV identity to identify the wireless device inside theAA server or the aviation domain (e.g., UTM/USS). The 3GPP network(e.g., cellular operator) may assign the GPSI for the UAS service. TheAA server may use the GPSI for communication with the 3GPP network.

The AA request message may trigger performing the authentication and/orauthorization procedure between the AA server and the wireless device.The detailed procedure for the service specific AA procedure isdescribed in FIG. 20 . If the service specific AA procedure iscompleted, the AA server may send an authentication and/or authorization(AA) response message to the AMF. The AA response message may comprisean authorization result, an authorized type, an authorized level,authorized paths, and/or the like. In an example, the AA completion maymean the use of service in application layer between the wireless deviceand the AA server is ready.

In an example, the AMF may receive an AA response message from the AAserver. In response to receiving the AA response message, the AMF maysend a configuration update message indicating the authorization result(e.g., whether the wireless device is authenticated and authorized forthe UAS service). If the authorization result indicates that the UASservice is not authenticated/authorized for the wireless device (e.g.,the authentication/authorization is failed), the wireless device may notrequest an establishment of one or more PDU sessions associated with theUAS service. If the authorization result indicates that the UAS serviceis authenticated/authorized for the wireless device (e.g., theauthentication/authorization is succeeded), the wireless device mayrequest an establishment of one or more PDU sessions associated with theUAS service to a SMF. In an example, the AAA-S may be the AA server.

In an example implementation, the AMF may not perform the AA procedurefor the UAS. The SMF may perform the AA procedure for the UAS service bysending AA request message to an AA server. If the SMF performs the AAprocedure, the AA procedure may be part of the PDU session establishmentprocedure.

FIG. 20 illustrates an example service specific authentication and/orauthorization procedure. An access and mobility management function(AMF) may trigger the start of the service specific authenticationand/or authorization procedure for a service. The AMF may be a mobilitymanagement entity (MME). The AMF may send an extensible authenticationprotocol (EAP) Identity Request for the service in a NAS MM Transportmessage including the service name to a wireless device. The wirelessdevice may provide the EAP Identity Response for the service alongsidethe service name in an NAS MM Transport message towards the AMF. The AMFmay send the EAP Identity Response to an authentication and/orauthorization (AA) server in an authentication request (EAP IdentityResponse, AAA-S address, GPSI, a service name) message. If the AAA-P ispresent (e.g., because the AAA-S belongs to a third party and theoperator deploys a proxy towards third parties), the AA server forwardsthe EAP ID Response message to the AAA-P. Otherwise, the AA serverforwards the message directly to the AAA-S. The AA server may usetowards the AAA-P or the AAA-S a AAA protocol message of the sameprotocol supported by the AAA-S. The AAA-P may forward the EAP Identitymessage to the AAA-S addressable by the AAA-S address together with theservice and GPSI. The AAA-S may store the GPSI to create an associationwith the EAP Identity in the EAP ID response message, so the AAA-S maylater use the GPSI to revoke authorization or to triggerreauthentication. EAP-messages may be exchanged with the wirelessdevice. One or more iterations of these steps may occur. If EAPauthentication completes, the AAA-S may store the service for which theauthorization has been granted, so the AAA-S may decide to triggerreauthentication and reauthorization based on its local policies. AnEAP-Success/Failure message may be delivered to the AAA-P (or if theAAA-P is not present, directly to the AA server) with GPSI and theservice name. If the AAA-P is used, the AAA-P may send a AAA Protocolmessage including (EAP-Success/Failure, the service name, GPSI) to theAA server. The AA server may send the Authenticate Response(EAP-Success/Failure, the service mane, GPSI) to the AMF. The AMF maytransmit a NAS MM Transport message (EAP-Success/Failure) to thewireless device. The AMF may store the EAP result for each service forwhich the service specific authentication and/or authorization procedureexecuted. In an example, the AAA-S may be the AA server.

FIG. 21 depicts a 4G network (e.g., 4G system, evolved packet system(EPS)) comprising of a 4G access network and a 4G core network (e.g.,evolved packet core (EPC)). In an example, the 4G access network maycomprise a radio access network (RAN) connecting to a 4G core network.The RAN may apply an evolved universal terrestrial radio access (E-UTRA)technology. The RAN may be a E-UTRA network (E-UTRAN). The 4G corenetwork may comprise one or more mobility management entities (MME)s,one or more home subscriber servers (HSS)s, one or more gateways foruser plane (e.g., Serving gateway (S-GW, SGW), Packet data networkgateway (P-GW, PGW, PDN GW)), one or more policy and charging rulesfunction (PCRF) and/or the like. If the 4G network supports an unmannedand/or uncrewed aerial system (UAS), the 4G core network may furthercomprise an UAS network function (NF). A traffic manager for the UASservice (e.g., UTM, USS) may be connected to the UAS NF. The MME may bea node or a network function in charge of at least one of: a non-accessstratum (NAS) signaling and security, mobility of a wireless device, areachability of the wireless device, an access control of the wirelessdevice, authentication, and authorization, and/or the like. The MME maybe equivalent to an AMF and may comprise partial functionalities of asession management function (SMF) of the 5G system. The S-GW may be agateway which terminates a user plane interface (e.g., S1-U) towards the4G access network. The S-GW functionalities may comprise a localmobility anchor point for inter-RAN (e.g., inter eNB, inter basestations) handover, a packet routing and forwarding, idle mode packetbuffering and/or the like. The P-GW (e.g., PDN-GW) may be a gatewaywhich terminates SGi interface towards the data network (e.g., packetdata network (PDN), DN). The P-GW functionalities may comprise an IPaddress allocation for the wireless device, transport level packetmarking in the uplink and downlink (e.g., setting a DiffServ code point,based on a QCI, priority), service level gating control, service levelrate enforcement. As an implementation option, the S-GW and the P-GW maybe separated to control plane functions and a user plane functions. Thecontrol plane functionalities of the S-GW and the P-GW (e.g., S-GW-C,P-GW-C) may be equivalent to the SMF of the 5G system. The user planefunctionalities of the S-GW and the P-GW (e.g., S-GW-U, P-GW-U) may beequivalent to a user plane function (UPF) of the 5G system. The HSS maybe a node storing subscription information of the wireless device. TheHSS may also support an authentication and/or authorization of thewireless device. The HSS may be a node in charge of the functionality ofthe UDM of the 5G system. In an example, a wireless device (e.g., UE)may attach to the MME by sending an attach request message to get one ormore services from the 4G network. The wireless device may send a PDNconnectivity request message to the MME to make one or more sessionsbetween the wireless device and the data network (DN) via the gatewaysfor the user plane. The one or more sessions may be one or more packetdata network (PDN) connections between the wireless device and one ormore P-GWs.

FIG. 22 depicts an example network architecture for inter-systeminterworking between a 4G system (e.g., 4G network) and a 5G system(e.g., 5G network) in accordance with embodiments of the presentdisclosure. Left side of the FIG. 22 may be the 4G system comprising anMME, a E-UTRAN and an SGW. The right side of the FIG. 22 may be the 5Gsystem comprising an AMF, a NG-RAN. A UE (e.g., wireless device) mayconnect to the E-UTRAN or the NG-RAN via the Uu interface. The UE may bea wireless device. The Uu interface between the E-UTRAN and the wirelessdevice may be an LTE Uu. The Uu interface between the NG-RAN and thewireless device may be a NR Uu. One or more nodes or network functionsmay be common network nodes or common network functions which are sharedbetween the 4G system and the 5G system. The common network nodes maycomprise a subscription information storage function (e.g., HSS+UDM), apolicy function (PCRF+PCF), control plane gateway functions (SMF+PGW-C),user plane gateway functions (UPF+PGW-U) and/or the like. In an example,the common network nodes may comprise the 4G system function and the 5Gsystem function to employ an interworking when the wireless device movesbetween a E-UTRAN coverage area and a NG-RAN coverage area.

In FIG. 22 , there is a N26 interface between the MME and the AMF. TheN26 interface may be an inter-core network interface between the MME of4G system and the AMF of the 5G system. The N26 may enable interworkingbetween the 4G system and the 5G system. Networks that supportinterworking between the 4G system and the 5G system, may supportinterworking procedures that use the N26 interface or interworkingprocedures that do not use the N26 interface. A network node (e.g., MME,AMF) may indicate to the wireless device whether the network supportsinterworking procedure with N26 or without N26. The network node mayindicate whether the network supports interworking procedure with N26 orwithout N26, by sending an interworking parameter to the wirelessdevice. If the network supports N26 interface (e.g., interworkingprocedure with N26), the interworking parameter may be set as“interworking without N26 interface not supported”. If the network doesnot support N26 interface (e.g., interworking procedure without N26),the interworking parameter may be set as “interworking without N26interface supported”.

In an example, the interworking procedures using the N26 interface, mayenable an exchange of mobility management context and sessionmanagements states (e.g., contexts) of the wireless device between the4G system and the 5G system. When the interworking procedures with N26is used, the wireless device may operate in a single-registration mode.For the single-registration mode, the wireless device may keep one validregistration (e.g., attach) association either with the 4G system in theMME or with the 5G system in the AMF. When interworking procedureswithout N26 is used, the wireless device may operate in adual-registration mode. In dual-registration mode, the wireless devicemay perform independent registration for the 4G system and the 5Gsystem. In dual-registration mode, the wireless device may be allowed toregister with the 5G system and to attach (e.g., register) with the 4Gsystem simultaneously.

FIG. 23 illustrates an example authentication and/or authorizationprocedure for a UAS service in a 4G system between a wireless device(e.g., UE), a mobility management function (e.g., MME), a sessionmanagement function (e.g., PGW-C), one or more user plane gateways(e.g., PGW-U, SGW), a subscription server (e.g., HSS), a UAS NF, and atraffic manager (e.g., UTM, USS). The traffic manager may be an AAserver. In an example, the wireless device may access the 4G system viaa base station (e.g., gNB). The base station is not shown in figure FIG.23 . The wireless device may access to the MME or to the SGW via thebase station (e.g., E-UTRAN, eNB). The mobility management function maybe a mobility management entity (MME). The subscription server may be ahome subscriber service (HSS). The session management function may be aPGW-C.

In an example, the wireless device may send an attach request message tothe MME via the base station. The wireless device may be an unmannedand/or uncrewed aerial vehicle (UAV). The attach request message maycomprise an identity of the wireless device, a capability of the UASservice, a civil aviation authority (CAA) UAV identifier, and/or thelike. The attach request message may further comprise a request for apacket data network (PDN) connectivity to a data network. If the 4Gsystem does not support “attach without PDN connectivity”, the wirelessdevice may include the request for the PDN connectivity in the attachrequest message. The request for the PDN connectivity may be codedinside an EPS session management (ESM) message container. The PDNconnectivity request may comprise an EPS bearer identity, an accesspoint name (APN), the CAA UAV identifier, protocol control options(PCO), and/or the like. The wireless device may send the PDNconnectivity request to the MME, to request an establishment of a PDNconnection between the wireless device and the PGW (e.g, PGW-U) towardto data network (DN). The PCO may comprise information associated withan application (e.g., UAS service). In an example, the PCO may comprisethe CAA UAV identifier. The PCO may comprise flight authorizationidentity. The PCO is for a communication between a session managementcontroller (e.g., SMC, SMF, PGW-C) and the wireless device. The wirelessdevice may receive the CAA UAV identifier and the flight authorizationidentity from the traffic manager (e.g, UAS server, UTM, USS).

In an example, the MME may receive the attach request message. Inresponse to receiving the attach request message from the wirelessdevice, the MME may perform a primary authentication and/orauthorization (AA) of the wireless device with the HSS. The MME mayperform the primary AA of the wireless device based on the identity ofthe wireless device. The identity of the wireless device may be a anIMSI or a GUTI. If the wireless device is authenticated by the MME, theMME may select a PGW-C for the wireless device based on the request forthe PDN connectivity. In an example, the MME may select the PGW-C basedon the APN, the CAA UAV identifier and/or like. In an example, the APNmay be associated with a UAS service. The MME may select the PGW-C ifthe PGW-C support connection toward the UAS service. The MME may send acreate session request message to the PGW-C. The create session requestmessage may comprise the APN, the PCO, the CAA UAV identity, and/or thelike.

In response to receiving the create session request message, the PGW-Cmay determine whether to perform an AA procedure for the UAS service.The PGW-C may determine whether to perform the AA procedure for the UASservice based on the APN, the PCO, the CAA UAV identity, local policy,and/or the like. In an example, the APN may be associated with the UASservice. In an example, the PCO may comprise the flight authorizationidentity. In an example, the local policy may indicate an AA for the UASservice is requested if the PDN connectivity is for the UAS service.Based on the determination, the PGW-C may perform the authenticationand/or authorization (AA) procedure for the UAS service by sending anauthentication and/or authorization (AA) request message to anauthentication and/or authorization (AA) server. The PGW-C may send theAA request message for the UAS service to the AA server via an UASnetwork function (NF). The AA server may be the traffic manager (e.g.,the UTM or the USS). The AA request message may comprise the CAA UAVidentity, a 3GPP UAV identity, one or more parameters of the PCO, and/orthe like. The 3GPP UAV identity may be a GPSI. The AA server may use theCAA UAV identity to identify the wireless device inside the AA server orthe aviation domain (e.g., UTM/USS). The 3GPP network (e.g., cellularoperator) may assign the GPSI for the UAS service. The AA server may usethe GPSI for communication with the 3GPP network (e.g., UAS NF, PGW-C).

The AA request message may trigger performing the authentication and/orauthorization procedure between the AA server and the wireless device.The detailed procedure for the service specific AA procedure isdescribed in FIG. 20 . In this example embodiment, the AMF of the FIG.20 may be the PGW-C. If the service specific AA procedure is completed,the AA server may send an authentication and/or authorization (AA)response message to the PGW-C. The AA response message may comprise anAA result, an authorized type, an authorized level, authorized paths,and/or the like. The AA response message may comprise a RID, trackinginformation, and/or the like. The In an example, the AA completion maymean the use of service in application layer between the wireless deviceand the AA server is ready.

Referring again the FIG. 23 , the P-GW may receive the AA responsemessage for the AA server (via the UAS NF). In response to receiving theAA response message, the PGW-C may accept or reject the request for thePDN connectivity based on the AA result. In an example, if the AA resultindicate an AA failure of the wireless device, the PGW-C may reject thePDN connectivity request and indicate the rejection to the MME and thewireless device. If the AA result indicate an AA success for thewireless device, the PGW-C may accept the request for the PDNconnectivity and indicate the acceptance to the MME and the wirelessdevice. If the PGW-C accepts the request for the PDN connectivity, thePGW-C may request to a PGW-U a session establishment for the PDNconnectivity request. If the PGW-C accepts the PDN connectivity request,the PGW-C may send a create session response message to the MME vis theSGW. The create session response message may comprise PCO. The PCO maycomprise the RID, tracking information, and/or the like. In response toreceiving the create session response message, the MME may send anattach accept message comprising the PCO to the wireless device. Theattach accept message may comprise an activate default EPS bearercontext request. The activate default EPS bearer request may comprisethe PCO.

In an example implementation, the acceptance or rejection for the PDNconnectivity request (e.g., the request for the PDN connectivity) andthe AA procedure for the UAS service may be separated. In response toreceiving the create session request message from the MME, the PGW-C mayaccept the establishment of the PDN connectivity request and indicate tothe wireless device. The PGW-C may accept the establishment of the PDNconnectivity even the AA procedure is not started or not completed yet.This may decrease a delay for the attach procedure. When the PGW-Caccepts the establishment of the PDN connectivity, the PGW-C mayindicate to the wireless device, that the wireless device should notstart any service or data transmission associated with the UAS service.The PGW-C may initiate the AA procedure for the UAS service by sendingan AA request message to the AA server. If the PGW-C receives an AAresponse message indicating the AA success, The PGW-C may indicate tothe wireless device, the wireless device is allowed to start service ordate transmission associated with the UAS service.

In an example implementation, the 4G system may support “attach withoutPDN connectivity”. The wireless device may not include the request forthe PDN connectivity (e.g., requesting an establishment of the PDNconnection) in the attach request message. If the wireless devicereceives an attach accept message in response to sending the attachrequest message, the wireless device may send the request for the PDNconnectivity separately.

In existing technologies, a wireless device (e.g., unmanned and/oruncrewed aerial vehicle) may communicate, via cellular networks (e.g.,4G network, 5G network, etc.), with one or more network devicesassociated with an aerial service (e.g., unmanned and/or uncrewed aerialservice (UAS) service). The network device may be, for example, a UTM,USS or UAV controller. In an example, the wireless device may be anunmanned and/or uncrewed aerial vehicle (UAV). The wireless device mayfly above residential areas or fly next to other aerial vehicles. Due tosafety issues (e.g., crashes) and privacy issues, the wireless device(e.g., UAV) may require authentication and/or authorization (AA) from aserver (e.g., AA server) associated with the UAS service (e.g., UTM,USS) before obtaining aerial service. The authentication and/orauthorization status of the wireless device may be referred to asauthentication and/or authorization status (AA status), USS UAVauthentication and/or authorization status (UUAA status), etc. Forexample, in addition to a primary AA from the cellular networks, thewireless device require additional AA from the AA server. To increaserange, the wireless device may support both the 5G capability and 4Gcapability. If the wireless device moves between a 5G network area and a4G network area, the 5G network and the 4G network may supportinterworking of the wireless device between the two networks (5Gnetwork, 4G network) for service continuity.

AA procedures for UAS service may complicate handover from a 4G networkto a 5G network. For example, if a wireless device hands over from the4G network to the 5G network, an access and mobility management function(AMF) of the 5G network may be required to ensure that the wirelessdevice is authorized and/or authenticated for the aerial service.Accordingly, the AMF may trigger an AA procedure. Completion of the AAprocedure may be associated with signaling overhead and/or delay. Thehandover may be incomplete (e.g., not commenced and/or not fullycompleted) until such time as the AA status of the wireless device isresolved.

In accordance with example embodiments of the present disclosure, theMME may indicate an AA status for an aerial service of a wireless deviceto an AMF. For example, the MME may be associated with a first network(e.g., a 4G network) and the AMF may be associated with a second network(e.g., a 5G network). The MME may send in the indication to the AMFbased on a handover request of the wireless device. For example, thehandover request may be received from a first base station of the firstnetwork, and may indicate handover to a second base station of thesecond network. The indication may be sent to the AMF in any suitablemanner. For example, the MME may store the AA status of the wirelessdevice in a context of the wireless device; the MME may send theindication of the AA status to the AMF during a context relocationprocedure for an inter-system handover; etc. Based on the AA statusprovided by the MME, the AMF may determine whether or not to perform theAA procedure (e.g., without unnecessary duplication of an AA procedurewhich has already been performed). For example, if the AA statusreceived from the MME indicates that the aerial service of the wirelessdevice is authenticated and/or authorized, then the AMF can avoidduplication of the AA procedure (for example, commencing/completinghandover while avoiding the signaling overhead and/or delay associatedwith an AA procedure). For example, if the AA status indicates that theaerial service of the wireless device is unknown, invalid, expired, orthe like, then the AMF may determine that the AMF should perform the AAprocedure (e.g., prior to commencing/completing the handover, duringhandover, after handover, etc.).

In accordance with example embodiments of the present disclosure, asession management controller (e.g., a PGW-C and/or an SMF) may indicatean AA status for an aerial service of a wireless device to a mobilitymanagement entity (MME). The MME may be associated with a first network(e.g., a 4G network). For example, the session management controller(SMC) may indicate the AA status during a session creation and/orestablishment procedure for the wireless device. The MME may managemobility of the wireless device based on the AA status of the wirelessdevice, share the AA status of the wireless device to facilitatemobility management, etc.

In an example, the MME may indicate to the session management controller(SMC), a parameter for a 5G capability of the wireless device.Indicating the AA status for the aerial service by the SMC to the MMEmay be based on the parameter. The SMC may indicate the AA status for awireless device if the wireless device is subject to handover to the 5Gnetwork. The SMC may aware that the wireless device is subject tohandover to the 5G network, based on the parameter.

In accordance with example embodiments of the present disclosure, the 5Gnetwork may select an AA procedure for the UAS service based on apotential interworking to 4G network of a wireless device. The wirelessdevice may indicate to an access and mobility management function (AMF),a 4G capability of the wireless device. Based on the indication that thewireless device is 4G-capable, the AMF may determine that a sessionmanagement controller (SMC) performs the AA procedure (e.g., instead ofthe AMF). If the wireless device is not 4G-capable (e.g., does notsupport 4G capability (e.g., S1 mode)), the AMF may determine that theSMC does not perform the AA procedure (e.g., that the AMF performs theAA procedure itself). If the AMF determines that the SMC performs the AAprocedure, the AMF may indicate to the SMC to perform an AA for the UAS.Therefore, the AA for the UAS in the 4G network and the 5G network ishandled in the SMC (e.g., PGW-C+SMF), the AMF may not perform theduplicated AA procedure for the UAS service.

FIG. 24 illustrates an example session establishment procedure in 4Gnetwork where a session management controller (SMC) may indicate an AAstatus for the UAS service to an MME. The MME may store the AA statusinto contexts of a wireless device (e.g., EPS mobility management (MM)context) in the MME. Later, as illustrated in FIG. 25 , the MME mayindicate the AA status for the UAS service to an AMF. The MME may send aforward relocation request message comprising the AA status for the UASservice as part of inter-system interworking (e.g., inter-systemhandover) procedures for the wireless device from the 4G network to a 5Gnetwork.

Referring to FIG. 24 , the wireless device may send a sessionestablishment request message to the MME. The session establishmentrequest message may be a PDN connectivity request message. The wirelessdevice may send the PDN connectivity request message as part of anattach request procedure as illustrated in FIG. 23 . The wireless devicemay be an unmanned and/or uncrewed aerial vehicle (UAV). The wirelessdevice may need to communicate with a UAS server for the UAV operation.The session establishment request may comprise a PCO, a CAA UAVidentity, an APN and/or the like. The APN may be associated with a UASservice. The wireless device may be capable to communicate to a 5Gnetwork. In an example, the wireless device may support N1 mode. The N1mode may be a mode of a wireless device allowing access to the 5G corenetwork via the 5G access network. If the wireless device is capable tocommunicate to the 5G network, the wireless device may indicate to theMME a capability parameter of the N1 mode during attach procedure. Theattach request message may comprise the capability parameter of the N1mode.

In an example, the MME may receive the session establishment requestmessage. In response to receiving the session establishment requestmessage, the MME may select a session management controller (SMC) basedon the CAA UAV identity, the APN, and/or the like. The MME may selectSMC which supports UAS service. The MME may select a SMC further basedon the capability parameter. In an example, the MME may select the SMCwhich supports inter-system interworking between the 4G network and the5G network based on the capability parameter.

In response to receiving the session establishment request message, theMME may send a first message to the SMC, requesting a creation of asession associated with the UAS service for the wireless device. In anexample, the first message may be a create session request message. Thefirst message may comprise the PCO, the CAA UAV identity, the APN,and/or the like. The MME may send the PCO to the SMC transparently(e.g., the MME does not interpret or decode the PCO). The first messagemay further comprise the capability parameter of the N1 mode. The firstmessage may further indicate that the wireless device is subject tohandover 5G network. The SMC may support an interworking between the 4Gnetwork and the 5G network. The SMC may comprise functionalities of aPGW-C, functionalities of a SMF, and/or the like. In an example, thePGW-C and the SMF may be implemented in the SMC.

In response to receiving the first message, the SMC may determine toperform an AA procedure for the UAS service. The determination may bebased on the APN, subscription information of the wireless device, theCAA UAV identity, PCO and/or the like. The SMC may send a second messageto an AA server, requesting an AA for the UAS service of the wirelessdevice. The second message may be an AA request message for the UASservice. In an example, the AA server may be an UAS server (e.g.,traffic manager, USS, UTM). The SMC may send the second message to theAA server via the UAS network function (NF). The second message maycomprise the CAA UAV identity, a 3GPP UAV identity (e.g., GPSI), the PCOand/or the like. As illustrated in FIG. 23 , the AA server may performthe AA procedure for the UAS service. If the AA procedure is completed,the AA server may respond to the SMC by sending an AA response message.The AA response message may comprise an AA result, a RID, trackinginformation, and/or the like. In an example, the AA result may indicatewhether the AA procedure is success or failure.

In response receiving the AA response, the SMC may indicate an AA statusto the MME based on the AA result. In an example, the SMC may send acreate session response message to the MME for the session establishmentrequest. The create session response message may comprise the AA status.In an example, the AA status may indicate whether the wireless device isauthenticated/authorized. In an example, the AA status may indicate thatthe AA is not performed. In an example, the AA status may indicate thatthe AA is successfully performed and valid. In an example, the AA statusmay indicate that the AA is failed. The AA status may indicate that theAA is not valid.

In an example, the 4G network may support interworking with N26interface between the MME and the AMF. The SMC may indicate the AAstatus to the MME if the 4G network supports interworking with N26interface. The MME may indicate to the SMC whether the 4G networksupports interworking with N26 interface or without N26 interface.

In an example implementation, the 4G network may support interworkingwithout N26 interface. The SMC may not indicate the AA status to the MMEif the 4G network supports interworking without N26 interface.

In an example, the SMC may indicate the AA status to the MME if thewireless device is capable to communicate to the 5G network. The MME mayaware whether the wireless device is capable to communicate to the 5Gnetwork based on the capability parameter. The capability parameter maybe provided by the wireless device or old MME. The SMC may indicate theAA status based on the capability parameter. The SMC may indicate the AAstatus if the SMC determines that the wireless device is subject toaccess to the 5G network.

In response to receiving the AA status from the SMC, the MME may storethe AA status into contexts of a wireless device in the MME. In responseto receiving the create session response message from the SMC, the MMEmay send a session establishment response message to the wirelessdevice. The session establishment response message may be an activatedefault EPS bearer context request.

In response receiving the AA response message, the SMC may accept orreject the PDN connectivity request based on the AA result. In anexample, if the AA result indicate an AA success for the wirelessdevice, the SMC may accept the PDN connectivity request and indicate theacceptance to the MME. Based on the acceptance, the SMC may select auser gateway (UGW) for the UAS service. The UGW may comprise a PGW-U,UPF, and/or the like. The SMC may establish a session with the UGW forthe wireless device. The session may be a PDN connection between thewireless device and the UGW toward a data network associated with theUAS service.

FIG. 25 illustrates an example inter-system handover procedure with N26interface between the 4G network and the 5G network where the MMEindicate to the AMF the AA status for the UAS service. The AMF maydetermine whether to perform an AA procedure with the wireless devicebased on the AA status provided by the MME. The AMF may selectivelyperform the AA procedure based on the AA status provided by the MME.

In an example, the wireless device may establish one or more sessionsassociated with a UAS service as explained in earlier (FIG. 24 ) whenthe wireless device accesses to the 4G network. The wireless device maymove to 5G network area. A first base station (e.g., BS1) may determinea handover of the wireless device to a second base station (BS2). Thefirst base station may determine the handover based on measurementreports provided by the wireless device. Based on the determination, thefirst base station may send a message requesting a handover of thewireless device to a second base station. The first base station maybelong to the 4G network. The second base station may belong to the 5Gnetwork. The message may be a handover required message. The message maycomprise an identifier of the second base station (e.g., IP address ofthe second base station), a handover type, source to target transparentcontainer information, and/or the like. The identifier of the secondbase station may comprise a global next generation node b identifier, aglobal next generation evolved node b identifier, a public land mobilenetwork (PLMN) identifier, a tracking area code of a 5G network, and/orthe like. The handover type may comprise an intra long term evolution(LTE), from the LTE to a universal terrestrial radio access network(UTRAN), from the LTE to a global system for mobile communications (GSM)radio access network (GERAN), from the UTRAN to the LTE, from the GERANto LTE, from the evolved packet system (EPS) to the 5G system (5GS),from the 5GS to the EPS, and/or the like. In an example, the handovertype may indicate that from the EPS to the 5GS. The 4G network may bethe EPS.

In response to receiving the message (e.g., handover required), the MMEmay send a second message to an access and mobility management function(AMF). The second message may indicate the AA status of the device. Thesecond message may request a relocation of contexts of the wirelessdevice. The second message may be a forward relocation request message.The second message may comprise the AA status for the UAS service of thewireless device. The second message may comprise an EPS mobilemanagement (MM) context of the wireless device. The EPS MM context(e.g., MME UE context) may comprise an IMSI, a mobile equipment (ME)identity, UE security context, UE network capability, EPS bearercontext(s), and/or the like. The EPS MM context may comprise the AAstatus for the UAS service.

In response to receiving the second message, the AMF may determinewhether to perform an AA procedure for the UAS service. In an example,the second message may not comprise the AA status for the UAS service ofthe wireless device. The MME may not provide the AA status in the secondmessage. If there is no AA status, the AMF may pause the interworkingprocedure. The AMF may perform the AA procedure by sending an AA requestmessage to an AA server as illustrated in FIG. 19 . The AMF may receivean AA response message. The AMF may determine that AA procedure issuccessful (e.g., the wireless device is authenticated and authorizedfor the UAS service) based on the AA response message. If the AA issuccessful, the AMF may continue the interworking procedure by sending aPDU session create request message to a session management controller(SMC) for the UAS service.

In an example, the second message may comprise the AA status for the UASservice of the wireless device. The AA status may indicate that thewireless device is authenticated and authorized for the UAS service(e.g., the wireless device has valid AA for the UAS service). If the AAstatus indicate that the UAS is authenticated and authorized for the UASservice, the AMF does not perform the AA procedure. If the AA statusindicate that the UAS is authenticated and authorized for the UASservice, the AMF may send the PDU session create request message for aUAS service.

In an example, the second message may comprise the AA status for the UASservice of the wireless device. The AA status may indicate that thewireless device is not authenticated and authorized or failed or expiredfor the UAS service. If the AA status indicate that the wireless devicedoes not have valid AA for the UAS service, the AMF may pause theinterworking procedure. If the wireless device does not have valid AAfor the UAS service, the AMF may perform the AA procedure by sending anAA request message to an AA server as illustrated in FIG. 19 . The AMFmay receive an AA response message. The AMF may determine that AAprocedure is successful (e.g., the wireless device is authenticated andauthorized for the UAS service) based on the AA response message. If theAA is successful, the AMF may continue the interworking procedure bysending a PDU session create request message to a session managementcontroller (SMC) for the UAS service.

If the AMF has a valid AA for the UAS service, the AMF may continue theinterworking procedure by sending the PDU session create request messageto the SMC. The SMC may perform session modification with a user gateway(UGW) to allocate core network tunnel for the PDU session. In responseto receiving the PDU session create response message, the AMF may send ahandover request message to the second base station. The handoverrequest message may comprise the source to target transparent container,session management information, tunnel information and/or the like. Ifthe AMF receive a handover request acknowledgement message, the AMF senda PDU session update request message to indicate a change of basestation (e.g., from BS1 to BS2) to the SMC. The SMC update the change ofbase station to the UGW. If the PDU session update is completed, the AMFmay send a forward relocation response message to the MME. The MME maysend a handover command message to the wireless device via the firstbase station, indicating to handover to the second base station. Inresponse to receiving the handover command message, the wireless devicemay access to the second base station. If the wireless device accessesto the second base station, the second base station may send a handovernotify message to the AMF indicating the wireless device successfullymoves to the second base station. In response to receiving the handovernotify message, the AMF may send a forward relocation complete notifymessage to the MME, indicating a completion of the interworkingprocedure. The AMF may send a session update request in the SMC toindicate a handover complete.

If the inter-system handover is completed, the wireless device may senda registration request message to the AMF to update registration area ofthe wireless device.

Example embodiment may decrease signaling overhead and service delay byavoiding a duplicated AA procedure for the UAS service after handoverfrom 4G network to the 5G network. The example embodiment may decreaseunnecessary handover (from 4G network to 5G network) of one or moresessions which are associated with the UAS service if the wirelessdevice is not authenticated and authorized.

In an example implementation, in response to receiving the secondmessage, the AMF may not perform the AA procedure. The AA status in thesecond message may indicate that the wireless device does not have validAA status (e.g., no AA status, or AA failed/expired). The AMF may notsend the AA request message but continue the inter-system interworkingprocedure without any pause. Later, the AMF may perform the AA procedurebased on AA status of the second message, after the inter-systemhandover completed. The AMF may send an AA request message, after thePDU session handover over from the first base station to the second basestation.

Example embodiment may decrease signaling overhead and service delay byavoiding a duplicated AA procedure for the UAS service after handoverfrom 4G network to the 5G network. The example embodiment may furtherdecrease service delay by performing the AA procedure after thecompletion of the inter-system handover procedure. However, the exampleembodiment may increase a number of unnecessary handover (from 4Gnetwork to 5G network) of sessions which are subject to release due tofailed AA procedure.

In an example implementation, in response to receiving the secondmessage, the AMF may perform the inter-system interworking procedure bysending the PDU session create request message to the SMC. If thewireless device does not have valid AA status, the AMF may still sendthe PDU session create request message for the inter-system interworkingprocedure. In response to receiving the second message, the AMF may alsoperform the AA procedure with the AA server by sending the AA requestmessage. Later, the AMF may request a release of PDU session for the UASservice if the AA procedure is failed. The AMF may update AA statusbased on the AA procedure.

Example embodiment may decrease signaling overhead and service delay byavoiding a duplicated AA procedure for the UAS service after handoverfrom 4G network to the 5G network. The example embodiment may furtherdecrease service delay by performing the AA procedure in parallel withthe inter-system handover procedure.

In an example implementation, an AMF may receive a message requesting arelocation of contexts of a wireless device. The message may comprise asession associated with an unmanned and/or uncrewed aerial system (UAS)service. In response to receiving the message, the AMF may determinethat the wireless device is authenticated and authorized by an AA serverfor the UAS service. The AMF may determine that the wireless device isauthenticated and authorized for the UAS service if the messagecomprises the session associated with the UAS service. The AMF may setan AA status for the UAS service of the wireless device is positive(e.g., success, valid) based on the determination. In an example, theAMF may send an AA request message to the AA server if the AA status isnegative.

Example embodiment may decrease signaling overhead and service delay byavoiding a duplicated AA procedure for the UAS service after handoverfrom 4G network to the 5G network. However, the example embodiment mayincrease security vulnerability of the 5G network.

In a 5G network, an access and mobility management function (AMF) may bein charge of an AA procedure for a UAS service for a first wirelessdevice. The first wireless device may be not allowed to request anestablishment of a PDU session associated with the UAS service before acompletion of the AA for the UAS service. Alternatively, a sessionmanagement controller (e.g., SMF, PGW-C+SMF) may be in charge of the AAprocedure for the UAS service for a second wireless device. The secondwireless device may be allowed to request an establishment of a PDUsession associated with the UAS service before completion of the AA forthe UAS service. The session management controller (SMC) may perform theAA procedure during an establishment of the PDU session for the secondwireless device. The SMC may reject the request for the establishment ofthe PDU session from the second wireless device if the AA for the UASservice of the second wireless device fails. The SMC may release theestablished PDU session with the second wireless device if the AA forthe UAS service of the second wireless device fails. The 5G network maydetermine whether the AMF performs the AA procedure, or the SMC performsthe AA procedure. The 5G network may determine who performs the AAprocedure based on local policy. In an example, 5G network A (e.g., PLMNA) may determine that the AMF performs the AA procedure. In an example,5G network B (PLMN B) may determine that the SMC performs the AAprocedure.

FIG. 26 illustrates an example procedure in 5G network regarding the 5Gnetwork determines a network node for an AA procedure for the UASservice based on a 4G capability parameter in accordance withembodiments of the present disclosure. The 5G network may determine whoperforms the AA procedure based on the local policy and the 4Gcapability parameter. The 4G capability parameter may be capability ofthe wireless device, indicating that the wireless device is subject tohandover to a 4G network area. The 4G capability parameter may indicatethat the wireless device may communicate to the 4G network. The 4Gcapability may be a capability of a S1 mode. The S1 mode may be a modeof a wireless device allowing access to the 4G core network via the 4Gaccess network.

In an example, the wireless device may indicate the 4G capability to theAMF. The wireless device may send a message to the AMF, the message maycomprise the 4G capability parameter. The message may be a registrationrequest message. The message may comprise a registration request typesetting as an initial request. In an example, the AMF may receive themessage comprising the 4G capability parameter.

In response to receiving the message, the AMF may determine who (e.g.,which network node) will perform the AA procedure. Based on theparameter, the AMF may determine that a SMC performs the AA procedurefor the UAS service of the wireless device. In response to thedetermination, the AMF may send a second message to the wireless device,indicating that an establishment of one or more PDU sessions associatedwith the UAS service is available. The second message may be aregistration accept message. The AMF may indicate to the wireless devicethat the AA for the UAS service is not pending. In response to receivingthe second message, the wireless device may send a session establishmentrequest message for the UAS service. The session establishment requestmessage may be a PDU session establishment request message. The sessionestablishment request message may comprise a DNN, a CAA UAV identity,PCO, S-NSSAI, and/or the like.

In response to receiving the session establishment request message, theAMF may select a SMC based on the DNN, S-NSSAI, the CAA UAV identifier,and/or the like. The AMF may indicate to the SMC the determination. TheAMF may indicate to the SMC that the SMC performs the AA procedure forthe UAS service. The AMF may send a second session establishment requestmessage indicating that the SMC perform the AA for the UAS service. Inresponse to receiving the second session establishment request messageindicating that the SMC perform the AA for the UAS service, the SMC maysend an AA request message to an AA server for the UAS service of thewireless device. The SMC may send the AA request message to the AAservice via an UAS network function (NF).

In an example, the AMF may receive a third message indicating that asecond wireless device is not capable to communicate to the 4G network.The third message may not comprise the 4G capability parameter. Thethird message may be a registration request message. If the wirelessdevice is not capable to communicate to the 4G network based on thethird message, the AMF may determine that the AMF performs the AAprocedure for the UAS service. Based on the determination, the AMF maysend an AA request message to the AA server, requesting the AA for theUAS service of the second wireless device. In response to thedetermination, the AMF may indicate to the second wireless device thatan establishment of one or more sessions associated with the UAS serviceis not allowed for the second wireless device. In response to thedetermination, the AMF may indicate to the second wireless device thatan establishment of one or more sessions associated with the UAS serviceis pending for the second wireless device.

Example embodiment may decrease signaling overhead and service delay byavoiding a duplicated AA procedure for the UAS service. Exampleembodiment may allow the 5G network determine that the SMC performs theAA procedure if a wireless device is subject to handover the 4G network.The duplicated AA procedure may be avoided since the same node (e.g.,SMC) is in charge of the AA procedure. Example embodiment may decreaseimpact to the legacy system (e.g., 4G network). Example embodiment maywork both for interworking with N26 interface and interworking withoutN26 interface.

In an example, a mobility management entity (MME) of a fourth generation(4G) network from a first base station may receive a message requestinga handover of a wireless device to a second base station. The secondbase station may belong to a fifth generation (5G) network. In responseto receiving the message, the MME may send to an access and mobilitymanagement function (AMF), a second message requesting a relocation ofcontexts of the wireless device. The second message may comprise anauthentication and/or authorization (AA) status of the wireless devicefor an unmanned and/or uncrewed aerial system (UAS) service.

In an example, the MME may receive from the wireless device, an attachrequest message. The attach request message may comprise a parameterindicating that the wireless device is capable to communicate to the 5Gnetwork, an access point name (APN) associated with the UAS service,and/or the like. The MME may send to a session management controller(SMC), a third message requesting a creation of a session. The thirdmessage may comprise the parameter and the APN. The MME may receive fromthe session management controller, a fourth message indicating acreation of the session. The fourth message may comprise a protocolconfiguration option (PCO) for the wireless device, the AA status,and/or the like.

In an example, the MME may store the AA status for the UAS service intothe contexts of the wireless device in the MME.

In an example, receiving the third message comprising the AA status, maybe based on the parameter indicating that the wireless device is capableto communicate to the 5G network.

In an example, the MME may select the session management controllersupporting interworking between the 4G network and the 5G network. Theselection may be based on the parameter.

The session management controller may comprise one or more of a packetdata network gateway control plane function of the 4G network, a sessionmanagement function (SMF) of the 5G network, and/or the like. Thesession management controller may select a user plane gateway for thesession. The session may be between the wireless device and the userplane gateway.

In an example, the user plane gateway may comprise one or more of: apacket data network (PDN) gateway user plane function: and a user planefunction (UPF).

In an example, the wireless device may send data associated with the UASservice via the session to the user plane gateway.

In an example, the attach request message may further comprise anidentifier of the wireless device, an unmanned and/or uncrewed aerialvehicle (UAV) identifier, and/or the like.

In an example, the PCO may comprise the AA status.

In an example, the PCO may not comprise the AA status.

The PCO may be between the session management controller and thewireless device. The MME may send the PCO to the wireless devicetransparently.

In an example, the AA status for the UAS service may indicate whetherthe wireless device is authenticated or authorized by an AA serverassociated with the UAS service.

The 4G network may comprise the first base station. The 5G network maycomprise the second base station and the AMF.

In an example, the wireless device may be an unmanned and/or uncrewedaerial vehicle (UAV).

In an example, the message comprises one or more of an identifier of thesecond base station, a handover type, source to target transparentcontainer information, and/or the like. The identifier of the secondbase station may comprise a global next generation node b identifier, aglobal next generation evolved node b identifier, a public land mobilenetwork (PLMN) identifier, a tracking area code of a 5G network, and/orthe like. The handover type may comprise an intra long term evolution(LTE), from the LTE to a universal terrestrial radio access network(UTRAN), from the LTE to a global system for mobile communications (GSM)radio access network (GERAN), from the UTRAN to the LTE, from the GERANto LTE, from the evolved packet system (EPS) to the 5G system (5GS),from the 5GS to the EPS, and/or the like. The handover type may be fromthe EPS to the 5GS.

In an example, the 4G network may be an evolved packet system (EPS).

In an example, a session management controller (SMC) may receive from amobility management entity (MME), a first message requesting a creationof a session associated with an unmanned and/or uncrewed aerial system(UAS) service for a wireless device. The SMC may send to anauthentication and/or authorization (AA) server of the UAS service, asecond message requesting an AA for the UAS service of the wirelessdevice. The SMC may receive from the AA server, an AA result for the UASservice. The SMF may send to the MME, an AA status comprising the AAresult.

In an example, the first message may further comprise a parameterindicating that the wireless device is capable to communicate to a fifthgeneration (5G) network. The sending the AA status may be based on theparameter.

In an example, the SMC may support an interworking between a fourthgeneration (4G) network and a fifth generation (5G) network. The SMC maycomprise one or more of a packet data network gateway control planefunction of the 4G network, a session management function (SMF) of the5G network, and/or the like.

In an example, first message may comprise an unmanned and/or uncrewedaerial vehicle (UAV) identifier.

The sending of the second message may be based on the UAV identifier.

In an example, an access and mobility function (AMF) may receive from amobility management entity (MME), a message requesting a relocation ofcontexts of a wireless device. The message may comprise anauthentication and/or authorization (AA) status for an unmanned and/oruncrewed aerial system (UAS) service of the wireless device The AMF maydetermine based on the AA status, whether the wireless device isauthenticated and authorized for the UAS service.

Based on the determining, the AMF may send to an authentication and/orauthorization (AA) server of the UAS service, a second messagerequesting an AA for the UAS service of the wireless device.

Based on the determining, the AMF may not send to an authenticationand/or authorization (AA) server for the UAS service, a second messagerequesting an AA of the wireless device.

In an example, an access and mobility function (AMF) may receive from amobility management entity (MME), a message requesting a relocation ofcontexts of a wireless device. The message may comprise a sessionassociated with an unmanned and/or uncrewed aerial system (UAS) service.Based on the sessions (e.g., existence of the session associated withthe UAS service), the AMF may determine the wireless device isauthenticated and authorized by an authentication and/or authorization(AA) server for the UAS service. The AMF may set/configure, an AA statusfor the UAS service of the wireless device being positive, wherein thesetting is based on the determining.

In an example, the AMF may send to the AA server, a second messagerequesting an AA for the UAS service of the wireless device. The sendingmay be based on the AA status being negative.

In an example, an access and mobility function (AMF) may receive from awireless device, a message comprising a parameter indicating that thewireless device is capable to communicate to a fourth generation (4G)network. Based on the parameter, the AMF may determine that a sessionmanagement controller (SMC) performs an authentication and/orauthorization (AA) for an unmanned and/or uncrewed aerial system (UAS)service of the wireless device instead of the AMF. The AMF may indicateto the SMC, that the SMC performs the AA for the UAS service.

In an example, the AMF may indicate to the wireless device, that asession establishment for the UAS service is allowed for the wirelessdevice.

The AMF may select the SMC based on at least one of a data network name(DNN), single network slice selection assistance information (S-NSSAI),an CAA unmanned and/or uncrewed aerial vehicle (UAV) identifier, and/orthe like.

In an example, the AMF may receive from a second wireless device, asecond message. The second message may not comprise the parameterindicating the 4G access capability of the wireless device. Based on thesecond message, the AMF may determine that the AMF performs the AA forthe UAS service. The AMF may send to an AA server, third messagerequesting the AA for the UAS service of the wireless device.

In an example, the AMF may indicate to the wireless device, that asession establishment associated with the UAS service is not allowed forthe wireless device.

In an example, the AMF may indicate to the wireless device, that asession establishment associated with the UAS service is pending for thewireless device.

The SMC may comprise one or more of a packet data network gatewaycontrol plane function of the 4G network, a session management function(SMF) of a fifth generation (5G) network.

In an example, the 5G network may comprise the AMF.

In an example, the wireless device may be registered with the 4Gnetwork.

In an example, a session management controller (SMC) may receive from anaccess and mobility function (AMF), a message indicating that a SMCperforms an authentication and/or authorization (AA) for an unmannedand/or uncrewed aerial system (UAS) service. The SMF may send to an AAserver, a second message requesting the AA for the UAS service of thewireless device. The sending may be based on the message.

In an example, a wireless device may send to an access and mobilityfunction (AMF), a first message indicating that the wireless device iscapable to communicate to a fourth generation (4G) network. The wirelessdevice may receive, a second message that the wireless device is allowedto make one or more sessions associated with an unmanned serial service.The second message may be based on the message.

1. A method comprising: receiving, by the MME from the wireless device,an attach request message comprising at least one of: the parameterindicating that the wireless device is capable of communicating with the5G network; and the APN associated with the aerial service; sending, bythe MME to the session management controller, a request for the creationof the session, wherein the request for the creation of the sessioncomprises at least one of: a parameter indicating that the wirelessdevice is capable of communicating with a fifth generation (5G) network;and an access point name (APN) associated with the aerial servicereceiving, by the MME from a session management controller, theindication of the AA status, wherein the indication of the AA status isreceived in a message indicating creation of a session of the wirelessdevice; receiving, by a mobility management entity (MME) from a firstbase station, a request for a handover of a wireless device to a secondbase station; and based on the handover request, sending, by the MME toan access and mobility management function (AMF), an indication of anauthentication and/or authorization (AA) status for an aerial service ofthe wireless device.
 2. The method of claim 1, wherein the handover isfrom a first network to a second network.
 3. The method of claim 2,wherein the MME is of the first network and the AMF is of the secondnetwork.
 4. The method of claim 1, wherein the indication of the AAstatus is sent to the AMF via an N26 interface.
 5. The method of claim1, wherein the indication of the AA status is sent to the AMF in aprotocol configuration option (PCO) of the wireless device.
 6. Themethod of claim 1, wherein the PCO of the wireless device is between thewireless device and a session management controller.
 7. The method ofclaim 1, wherein the indication of the AA status is sent to the AMF in arelocation request message.
 8. The method of claim 7, wherein therelocation request message is a forward relocation request message. 9.The method of claim 7, wherein the relocation request message is arequest for relocation of a wireless device context of the wirelessdevice.
 10. The method of claim 1, further comprising maintaining and/orkeeping, by the MME, a wireless device context of the wireless device.11. The method of claim 10, further comprising storing, by the MME, theAA status of the wireless device is stored in the wireless devicecontext of the wireless device.
 12. The method of claim 1, wherein thesession of the wireless device is associated with the aerial service.13. The method of claim 1, wherein the session of the wireless devicecommunicates data of the aerial service.
 14. The method of claim 1,wherein the message indicating the creation of the session comprises aprotocol configuration option (PCO) of the wireless device.
 15. Themethod of claim 1, wherein the message indicating the creation of thesession comprises the AA status of the wireless device.
 16. The methodof claim 1, wherein the attach request message comprises at least oneof: a wireless device identifier of the wireless device; and an uncrewedand/or unmanned and/or uncrewed aerial vehicle (UAV) identifier of thewireless device.
 17. The method of claim 1, further comprisingselecting, by the MME, the session management controller based on thesession management controller supporting interworking between a 4Gnetwork and the 5G network.
 18. The method of claim 1, wherein thesession management controller comprises at least one of: a packet datanetwork gateway control plane function (PGW-C) of the 4G network; and asession management function (SMF) of the 5G network.
 19. The method ofclaim 1, wherein the session of the wireless device is between thewireless device and a user plane gateway selected by the sessionmanagement controller.
 20. A method comprising: receiving, by a mobilitymanagement entity (MME) from a first base station, a request for ahandover of a wireless device to a second base station; selecting, bythe MME, the session management controller based on the sessionmanagement controller supporting interworking between a 4G network andthe 5G network; and based on the handover request, sending, by the MMEto an access and mobility management function (AMF), an indication of anauthentication and/or authorization (AA) status for an aerial service ofthe wireless device.